Cloudanix VulnDB

CVE-2020-16952

High · 8.6

CVSS

8.6

EPSS

71.1%

Published

Oct 16, 2020

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Attend

A flaw in the server software lets attackers run their own programs on the system simply by uploading a specially made file.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
RCE
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows remote code execution in the SharePoint application pool and farm account context because the software does not properly validate the source markup of an uploaded application package.

Why it matters to the business

Attackers can execute arbitrary code on SharePoint servers, leading to full server compromise, data theft, or disruption of collaboration services; high exploitability and weaponized maturity increase urgency for organizations running affected versions.

How an attack unfolds

An attacker crafts a malicious SharePoint application package containing unauthorized markup, uploads it to the target server, and triggers code execution in the application pool context; no authentication or user interaction is required.

How to fix it

Apply the vendor security update that corrects markup validation. Upgrade chromium (Debian:11) to 93.0.4577.82-1, chromium (Debian:12) to 93.0.4577.82-1, chromium (Debian:13) to 93.0.4577.82-1, or chromium-browser (Ubuntu:18.04:LTS) to 92.0.4515.159-0ubuntu0.18.04.1.

How to confirm the fix worked

Verify package upload validation succeeds only for trusted markup after patching; review SharePoint update logs and application pool behavior for successful installation of the listed fixed versions.

Typical attack path

  1. Identify an internet-facing or internal SharePoint instance
  2. Craft a specially formatted application package with malicious markup
  3. Upload the package through available SharePoint interfaces
  4. Trigger package processing to execute arbitrary code in the farm account context

How to detect it

Inspect SharePoint application upload and processing logs for entries showing unexpected package handling or markup validation failures around the time of suspected activity.

What your security team should do

  • Immediately upgrade all listed packages to the specified fixed versions
  • Restrict untrusted application package uploads until patches are applied
  • Monitor EPSS trend and exploit maturity indicators for prioritization

The record

<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p> <p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p> <p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities