CVE-2022-35823

What it actually does

This is a network-reachable remote code execution vulnerability in Microsoft SharePoint with low attack complexity and no user interaction requirement. Exploitation requires at least a low-privileged authenticated account, after which a crafted request to a vulnerable SharePoint server-side component can cause attacker-controlled code to run in the context of the SharePoint web application or service account. Successful exploitation can provide full confidentiality, integrity, and availability impact, including arbitrary command execution, file creation, data access through SharePoint permissions, deployment of web shells, and potential pivoting to connected Windows and Active Directory resources. The provided affected-product metadata also lists unrelated third-party packages; those should be separately validated because they do not align cleanly with the SharePoint description.

Why it matters to the business

An attacker with any valid SharePoint login could potentially take control of a vulnerable SharePoint server, steal or alter documents, disrupt collaboration services, and use the server as a foothold into broader internal infrastructure. Although this vulnerability is not listed in CISA KEV and no mature public exploit is indicated in the provided data, the EPSS score is elevated and the issue has been public for several years, so unpatched internet-facing or partner-accessible SharePoint deployments should be treated as high-priority remediation targets.

How an attack unfolds

An attacker first obtains or abuses a valid low-privileged SharePoint account through credential theft, password spraying, phishing, exposed test accounts, or a compromised partner identity. The attacker then identifies a vulnerable SharePoint instance and sends crafted authenticated HTTP requests to the affected SharePoint functionality. If the server is unpatched, SharePoint mishandles the request and executes attacker-controlled code under the SharePoint web application or service identity. The attacker commonly follows code execution by running reconnaissance commands, writing a web shell or other persistence mechanism into a SharePoint-accessible directory, dumping configuration files or credentials, accessing document libraries, and moving laterally using the privileges and network reachability of the compromised server.

How to fix it

Apply the relevant Microsoft SharePoint security updates from September 2022 or any later cumulative/security update that supersedes them for the deployed SharePoint version. Prioritize internet-facing, extranet, partner-accessible, and high-sensitivity SharePoint farms. After patching, run the SharePoint Products Configuration Wizard or equivalent farm configuration steps required by Microsoft so binaries and databases are fully updated. Restrict SharePoint access to trusted networks where possible, enforce MFA for SharePoint users, remove stale or low-value accounts, and limit service account privileges. If immediate patching is not possible, reduce exposure by blocking untrusted access paths, tightening authentication controls, and monitoring for authenticated exploitation attempts. The supplied package metadata also lists fixes for unrelated components: 10gen-archive/mongo-c-driver-legacy fixed at commit 1a1f5e26a4309480d88598913f9eebf9e9cba8ca, mongodb/mongo-c-driver fixed at commit 41562d5cda9ca79af3d23a7463e5faf4f2a4e20a, and Ubuntu 16.04 whoopsie fixed in 0.2.52.5ubuntu0.5; validate whether those packages are actually in scope before treating them as remediation for this SharePoint issue.

How to confirm the fix worked

Confirm all SharePoint servers in each farm are running a patched build level using SharePoint build inventory, installed update history, and SharePoint Management Shell checks. Verify the required post-update configuration step has completed successfully on every farm member. Confirm externally exposed SharePoint endpoints are patched, not just internal farm nodes. Review vulnerability scanner results against authenticated version checks rather than banner-only detection. Validate that low-privileged accounts cannot trigger unexpected server-side errors or code execution behavior. For the unrelated package metadata, confirm repository commits or package versions match the listed fixed versions only if those components are actually deployed.

Typical attack path

1. Acquire valid low-privileged SharePoint credentials.
2. Identify a reachable SharePoint server and confirm it is running an affected, unpatched build.
3. Send crafted authenticated HTTP requests to the vulnerable SharePoint component.
4. Achieve server-side code execution under the SharePoint worker process or service account context.
5. Execute discovery commands and enumerate local configuration, domain context, and accessible content repositories.
6. Deploy a web shell, scheduled task, service, or other persistence mechanism.
7. Exfiltrate SharePoint content, configuration secrets, or credentials and pivot to adjacent systems.

How to detect it

Look for evidence of authenticated exploitation in IIS logs, SharePoint ULS logs, SharePoint audit logs, Windows Security logs, Sysmon/EDR telemetry, PowerShell logs, and file integrity monitoring data. Correlate suspicious authenticated SharePoint requests with process creation events from SharePoint worker processes such as w3wp.exe, especially child processes like cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, rundll32.exe, mshta.exe, or csc.exe. Review IIS logs for unusual POST requests to SharePoint application paths, high-error sequences from a single authenticated user, requests followed by HTTP 500 responses, or activity from unexpected user agents. Inspect SharePoint web-accessible directories for newly written ASPX files, modified web.config files, unusual DLLs, and files with timestamps near suspicious requests. Review Windows Event ID 4688 and Sysmon Event ID 1 for command execution by SharePoint application pool identities. Review Sysmon Event ID 11 for file creation in SharePoint web roots and Event ID 3 for unexpected outbound connections from SharePoint processes. Also investigate unusual SharePoint service account logons, privilege escalation, new scheduled tasks, new services, credential dumping indicators, and outbound traffic to unfamiliar hosts after suspicious SharePoint activity.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> csc.exe
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\CONTROLTEMPLATES\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\
• C:\inetpub\wwwroot\wss\VirtualDirectories\
• web.config
• /_layouts/15/
• /_layouts/16/
• /_vti_bin/client.svc/ProcessQuery
• /_api/web/
• POST /_layouts/15/
• POST /_layouts/16/
• POST /_vti_bin/client.svc/ProcessQuery
• Event ID 4688
• Sysmon Event ID 1
• Sysmon Event ID 3
• Sysmon Event ID 11

What your security team should do

• Immediately inventory SharePoint servers, especially internet-facing and partner-accessible instances, and identify unpatched builds.
• Patch SharePoint to the applicable September 2022 or later Microsoft security update and complete post-patch farm configuration tasks.
• Hunt for historical exploitation before assuming patching alone is sufficient, focusing on authenticated suspicious requests followed by child processes from SharePoint worker processes.
• Review SharePoint service account privileges and remove unnecessary local administrator, domain, database, and file-share access.
• Enforce MFA and conditional access for SharePoint users to reduce the risk of low-privileged credential abuse.
• Inspect SharePoint web directories and configuration locations for recently created ASPX files, web shells, modified web.config files, and unauthorized binaries.
• Increase monitoring for IIS, SharePoint ULS, Windows process creation, Sysmon, EDR, and file-write events on SharePoint servers.
• If the environment contains the listed third-party packages, validate and patch them separately because the provided affected-product list appears inconsistent with the SharePoint vulnerability description.