Overview of the SharePoint Exploitation Campaign
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding the active exploitation of multiple vulnerabilities within Microsoft SharePoint Server. According to SecurityWeek, three specific flaws have been added to the Known Exploited Vulnerabilities (KEV) catalog, signaling that CVE-2024-38094 and others are currently being leveraged by threat actors. This CVE update highlights a persistent interest in SharePoint by sophisticated APT groups and cybercriminals due to the platform’s role in storing sensitive corporate intelligence.
The addition of these flaws to the KEV catalog mandates that Federal Civilian Executive Branch (FCEB) agencies apply patches by November 12, 2024. However, the risk extends to all private sector organizations utilizing on-premises SharePoint deployments, as these vulnerabilities provide a direct path to RCE.
Technical Analysis of CVE-2024-38094 and Related Flaws
The primary concern for security teams is CVE-2024-38094, a deserialization vulnerability that allows an authenticated attacker with Site Owner permissions—or higher—to execute arbitrary code on the server. While the requirement for authentication may seem like a high bar, the prevalence of Phishing attacks makes obtaining such credentials a minor obstacle for motivated attackers. Once an account is compromised, the attacker can leverage this flaw to move from a standard user to a system-level execution context.
Furthermore, CVE-2023-24955 represents an RCE flaw that was famously demonstrated during the Pwn2Own Vancouver contest. Performing a comprehensive CVE-2023-24955 SharePoint exploit analysis reveals that this flaw enables attackers to bypass sandbox restrictions when combined with other vulnerabilities. CISA also flagged CVE-2024-43461, a spoofing vulnerability in the Windows MSHTML platform. Although MSHTML is often associated with the retired Internet Explorer, its underlying components remain embedded in Windows and are frequently targeted to facilitate initial access or bypass security warnings.
How to detect CVE-2024-38094 exploit attempts in SharePoint Logs
Detection efforts should focus on identifying unusual child processes spawning from w3wp.exe (the IIS worker process) on SharePoint servers. SOC teams should monitor for the execution of PowerShell, cmd.exe, or system discovery tools that could indicate Lateral Movement. Integrating these logs into a SIEM with specific correlation rules for SharePoint’s Unified Logging Service (ULS) can help pinpoint exploitation attempts. Look for Event ID 1311 in the Windows Security log or unexpected .NET serialization errors in the application logs, which often accompany failed or successful deserialization attacks.
Context and Threat Actor Motivation
The inclusion of these vulnerabilities in the KEV catalog implies that Zero-Day exploitation likely occurred before patches were widely adopted. For many organizations, SharePoint serves as the backbone of internal collaboration, making it a high-value target for Ransomware affiliates and espionage units. A successful compromise allows attackers to establish a C2 channel, exfiltrate proprietary data, or encrypt entire document libraries.
Recommended Remediation and Defensive Strategies
Defenders must prioritize applying the Microsoft SharePoint Server 2019 and Subscription Edition patch guidance provided in the October 2024 security updates. Implementing Microsoft SharePoint Server RCE mitigation steps is vital for organizations unable to patch immediately. These steps include:
- Restricting Permissions: Audit Site Owner and Administrative roles to ensure the principle of least privilege is enforced, reducing the attack surface for CVE-2024-38094.
- Network Segmentation: Isolate SharePoint servers from the broader internet and use a Web Application Firewall (WAF) to inspect incoming traffic for malicious serialized objects.
- Endpoint Monitoring: Ensure that EDR solutions are active on all web-facing servers to identify TTP patterns consistent with web shell deployment.
- Zero Trust Adoption: Transition toward a Zero Trust architecture to limit the impact of compromised credentials and prevent attackers from moving laterally through the network.
Mapping these threats to the MITRE ATT&CK framework—specifically TA0001 (Initial Access) and TA0002 (Execution)—can assist in refining defensive postures against future SharePoint-targeted campaigns.