CVE-2024-30044

What it actually does

CVE-2024-30044 is a remote code execution vulnerability in Microsoft SharePoint Server. The CVSS vector indicates exploitation is network-accessible, low-complexity, requires no user interaction, but does require the attacker to already possess high privileges in SharePoint. Successful exploitation can allow execution of attacker-controlled code in the context of the SharePoint Server application, potentially enabling full compromise of the SharePoint application tier, access to stored content, modification of sites or workflows, and disruption of SharePoint services.

Why it matters to the business

A successful compromise of SharePoint can expose sensitive documents, intranet content, collaboration data, and business workflows, while also giving an attacker a foothold inside the Microsoft server environment. Because SharePoint is often integrated with identity, Office, document management, and business process systems, exploitation can lead to data theft, operational disruption, and lateral movement. Although this vulnerability is not currently listed in CISA KEV and no mature exploit is indicated in the supplied data, the high EPSS score suggests a meaningful likelihood of exploitation activity and warrants prompt remediation.

How an attack unfolds

An attacker first obtains or abuses a high-privilege SharePoint account, such as a farm, site collection, or administrative-level identity depending on the vulnerable code path. From a network position that can reach the SharePoint Server, the attacker sends a crafted request to the vulnerable SharePoint component. Because the issue is exploitable with low technical complexity and requires no victim interaction, the attack can be performed directly once the required privilege level is met. If successful, SharePoint processes attacker-controlled input in a way that results in code execution on the server. The attacker may then deploy web shells, run commands under the SharePoint service context, access or alter SharePoint content, create persistence through application or configuration changes, harvest credentials or tokens, and use the server as a staging point for movement deeper into the Windows domain.

How to fix it

Apply the relevant Microsoft SharePoint Server security updates released for CVE-2024-30044. Because no affected product list or exact fixed versions were provided, use the Microsoft Security Update Guide and the SharePoint build/version matrix to identify the correct cumulative update or security update for each installed SharePoint Server edition and language pack. Patch all SharePoint servers in the farm, including web front ends, application servers, and any servers hosting SharePoint components. After patching, run required SharePoint configuration steps, such as the SharePoint Products Configuration Wizard or equivalent PowerShell upgrade commands, to complete the farm upgrade. As interim risk reduction, restrict SharePoint administrative access, enforce MFA for privileged SharePoint and Windows accounts, limit network access to SharePoint administrative interfaces, review high-privilege memberships, disable unused custom solutions or features, and ensure endpoint protection is active on SharePoint servers.

How to confirm the fix worked

Confirm exposure by inventorying all Microsoft SharePoint Server instances and comparing installed build numbers against Microsoft’s fixed build guidance for CVE-2024-30044. Validate that every server in each SharePoint farm has the relevant security update installed and that the SharePoint configuration database upgrade status is healthy. Use Central Administration, PowerShell such as Get-SPFarm, Get-SPProduct -Local, and farm build checks to verify patch consistency. Confirm that SharePoint Products Configuration Wizard or psconfig completed successfully on all servers. Validate mitigation by testing that only approved privileged users can access SharePoint administrative functionality and that no unexpected high-privilege accounts exist. If feasible, perform authenticated vulnerability scanning against SharePoint servers using current scanner plugins that check for this Microsoft update.

Typical attack path

1. Acquire or compromise a high-privilege SharePoint account.
2. Confirm network access to the SharePoint Server web application.
3. Send a crafted authenticated request to the vulnerable SharePoint endpoint or component.
4. Achieve code execution in the SharePoint Server process context.
5. Run post-exploitation commands, deploy a web shell, or modify SharePoint configuration for persistence.
6. Access, exfiltrate, alter, or destroy SharePoint-hosted documents and collaboration data.
7. Attempt credential theft and lateral movement to other Microsoft or Windows infrastructure.

How to detect it

To determine whether exploitation already occurred, review IIS logs for authenticated requests from privileged accounts to SharePoint administrative or unusual application endpoints, especially followed by server errors, file writes, or abnormal response patterns. Examine SharePoint ULS logs for unexpected feature activation, solution deployment, timer job creation, workflow changes, administrative API use, or errors around request processing at the time of suspicious activity. Correlate Windows Security logs for privileged logons, new service creation, scheduled tasks, process creation, and account changes involving SharePoint servers. Use EDR or Sysmon telemetry to identify suspicious child processes spawned by IIS or SharePoint processes, including w3wp.exe, OWSTIMER.EXE, or related SharePoint service processes launching cmd.exe, powershell.exe, certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, net.exe, nltest.exe, whoami.exe, or archive/exfiltration tools. Search SharePoint web directories and the 15/16 hive layouts for newly created or modified .aspx, .ashx, .asmx, .config, .dll, or script files. Review farm solution packages, web.config changes, newly registered safe controls, unexpected assemblies in the Global Assembly Cache, and suspicious changes in SharePoint content or configuration. Investigate outbound network connections from SharePoint servers to unfamiliar hosts, especially after suspicious privileged SharePoint activity. No public exploit-specific markers were provided in the source data, so detection should focus on generic SharePoint RCE post-exploitation behavior and authenticated administrative misuse.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning net.exe
• w3wp.exe spawning nltest.exe
• OWSTIMER.EXE spawning cmd.exe
• OWSTIMER.EXE spawning powershell.exe
• C:\inetpub\wwwroot\wss\VirtualDirectories\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\*.ascx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\CONTROLTEMPLATES\*.ascx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\CONFIG\*.config
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\CONFIG\*.config
• C:\Windows\Microsoft.NET\assembly\GAC_MSIL\*.dll
• C:\Windows\Tasks\*.job
• C:\Windows\System32\Tasks\*
• web.config modified
• New-SPTrustedSecurityTokenIssuer
• Add-SPSolution
• Install-SPSolution
• Enable-SPFeature
• Start-SPAdminJob
• iisreset

What your security team should do

• Prioritize patching despite the absence of KEV status because the EPSS score is high and the vulnerability provides high-impact code execution once privileged access is obtained.
• Inventory all SharePoint Server farms, web front ends, application servers, language packs, and custom solution deployments.
• Apply the applicable Microsoft SharePoint security updates and complete post-update configuration steps across every farm member.
• Audit SharePoint administrators, farm administrators, site collection administrators, managed accounts, service accounts, and recently granted high-privilege permissions.
• Review SharePoint and IIS logs for suspicious authenticated administrative activity, unexpected file uploads, web shell-like requests, and unusual access from unfamiliar IP addresses.
• Hunt on SharePoint servers for new or modified ASPX files, suspicious child processes spawned by IIS or SharePoint worker processes, and PowerShell or command-shell execution.
• Restrict administrative access to SharePoint servers and SharePoint Central Administration using network controls and privileged access management.
• Ensure EDR coverage, PowerShell logging, IIS logging, Windows Security logging, and SharePoint ULS logging are enabled and retained long enough for investigation.