CVE-2022-38053

What it actually does

CVE-2022-38053 is a Microsoft SharePoint Server remote code execution vulnerability. A network-accessible attacker with low-privileged authenticated access can send crafted requests to a vulnerable SharePoint server and cause attacker-controlled code to execute on the server. Successful exploitation can compromise confidentiality, integrity, and availability of SharePoint content and may allow execution in the context of the SharePoint application pool or associated service account, depending on server configuration.

Why it matters to the business

Compromise of a SharePoint server can expose sensitive documents, internal portals, workflows, and authentication-related data, and can provide an attacker with a foothold for broader enterprise compromise. Although this issue is not listed in CISA KEV and no mature public exploit is indicated in the provided data, the EPSS score is high, meaning exploitation is statistically more likely than many other vulnerabilities. Organizations running affected SharePoint versions should treat remediation as high priority, especially where SharePoint is internet-facing or accessible to large user populations.

How an attack unfolds

An attacker first obtains valid low-privileged SharePoint credentials or abuses an already-compromised account. The attacker identifies a vulnerable SharePoint Server deployment and sends crafted authenticated HTTP requests to the affected SharePoint functionality. The vulnerable server processes the malicious input incorrectly, resulting in remote code execution. Once code execution is achieved, the attacker may run commands under the SharePoint web application context, access SharePoint content databases through the application, write web-accessible payloads, create persistence, dump configuration secrets, or use the server as a staging point for lateral movement.

How to fix it

Apply the Microsoft security updates that address CVE-2022-38053 for all affected SharePoint products, including Microsoft SharePoint Enterprise Server, Microsoft SharePoint Foundation, and Microsoft SharePoint Server. Because no exact fixed versions were provided in the input, validate patch applicability against the relevant Microsoft Security Update Guide entry for the installed SharePoint major version and cumulative update level. Prioritize internet-facing SharePoint servers and servers accessible by broad user populations. If immediate patching is not possible, restrict SharePoint access to trusted networks or VPN users, enforce strong authentication and MFA, reduce unnecessary user permissions, monitor for suspicious authenticated SharePoint activity, and ensure endpoint detection coverage on SharePoint servers. Mitigations should be treated as temporary; applying the vendor update is the durable fix.

How to confirm the fix worked

Confirm the installed SharePoint build level includes the Microsoft security update for CVE-2022-38053. Use SharePoint Central Administration, installed update inventory, PowerShell-based farm build checks, and enterprise patch management tooling to verify all SharePoint servers in the farm are updated consistently. Confirm that web front ends, application servers, and any additional SharePoint roles have been patched, then run the SharePoint Products Configuration Wizard if required by the update process. Validate that SharePoint services are healthy after patching and that externally exposed endpoints are still intentionally accessible. Exposure can be assessed by inventorying SharePoint servers, reviewing internet-facing assets, and confirming that unpatched SharePoint builds are no longer present.

Typical attack path

1. Obtain valid low-privileged SharePoint credentials through phishing, credential reuse, password spraying, or prior compromise.
2. Confirm the target is a vulnerable Microsoft SharePoint Server deployment.
3. Send crafted authenticated HTTP requests to the affected SharePoint endpoint or component.
4. Achieve server-side code execution under the SharePoint application context.
5. Execute reconnaissance commands and enumerate SharePoint configuration, users, content, and permissions.
6. Access or exfiltrate sensitive SharePoint documents and configuration data.
7. Establish persistence, deploy tooling, or use the SharePoint server to move laterally within the network.

How to detect it

To determine whether exploitation already occurred, review IIS logs, SharePoint ULS logs, Windows Security logs, PowerShell logs, EDR telemetry, and file system changes on SharePoint servers. Focus on suspicious authenticated requests to SharePoint shortly before abnormal server behavior, especially from unusual IP addresses, newly used accounts, or accounts with minimal legitimate SharePoint activity. Hunt for web server worker processes spawning command interpreters or scripting engines, unexpected PowerShell execution, new or modified files in SharePoint web directories, unexplained application pool crashes, outbound network connections from SharePoint servers to unfamiliar hosts, and unusual access to large volumes of documents. Correlate SharePoint user activity with endpoint telemetry on the server: suspicious HTTP requests followed by process creation, file writes, credential access, archive creation, or external network connections should be treated as high-confidence compromise evidence. No CVE-specific public IOC strings were provided, so detections should emphasize behavioral evidence of SharePoint RCE and post-exploitation.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\*.aspx
• C:\inetpub\wwwroot\wss\VirtualDirectories\*.aspx
• SharePoint ULS log entries showing unexpected application errors immediately followed by process creation from w3wp.exe
• IIS logs showing authenticated POST requests to SharePoint immediately followed by 500 responses and suspicious server-side process execution

What your security team should do

• Patch affected SharePoint servers as a high priority, with greatest urgency for internet-facing deployments.
• Inventory all SharePoint farms and confirm every server role is updated, not only the primary web front ends.
• Review SharePoint authentication logs and IIS logs for unusual authenticated activity from unfamiliar IP addresses or impossible-travel patterns.
• Audit low-privileged SharePoint accounts for abnormal access, newly granted permissions, or recent compromise indicators.
• Restrict SharePoint administrative and user access paths where possible, especially from the public internet.
• Ensure EDR, PowerShell logging, IIS logging, and SharePoint ULS logging are enabled and centrally retained.
• Hunt for post-exploitation behavior on SharePoint servers, including unexpected child processes from IIS worker processes, suspicious file writes, and outbound connections.
• Review SharePoint service account privileges and reduce excessive permissions that could increase post-exploitation impact.