CVE-2024-38018

What it actually does

This is a remote code execution vulnerability in Microsoft SharePoint Server. A network-accessible SharePoint instance can be abused through vulnerable server-side handling of crafted input, allowing an attacker with the required access to cause code to run on the SharePoint server. Successful exploitation can result in arbitrary command execution in the context of the SharePoint application pool or related service account, which may provide access to SharePoint content, configuration, credentials available to the process, and a path to further Windows domain compromise.

Why it matters to the business

Compromise of a SharePoint server can expose sensitive documents, intranet content, workflow data, and authentication material, and may allow attackers to pivot into other internal systems. Although this issue is not currently listed in CISA KEV and has no known public exploit maturity in the supplied data, the high CVSS score and elevated EPSS probability indicate meaningful exploitation risk, especially for internet-facing SharePoint deployments or environments where SharePoint stores regulated or business-critical data.

How an attack unfolds

An attacker first identifies a reachable SharePoint Server instance and determines whether it is running an unpatched version. Where authentication or a low-privileged account is required, the attacker obtains valid access through credential theft, password spraying, phishing, or abuse of an exposed account. The attacker then sends crafted requests to vulnerable SharePoint functionality to trigger unsafe server-side processing. If exploitation succeeds, code executes on the SharePoint server under the SharePoint web application or service context. The attacker may then deploy a web shell, run PowerShell commands, dump configuration secrets, access SharePoint content databases indirectly through application credentials, create persistence, and use the server as a foothold for lateral movement.

How to fix it

Apply the relevant Microsoft security updates for SharePoint Server released for this vulnerability across every SharePoint server in the farm. Because no exact affected products or fixed versions were supplied, use the Microsoft Security Update Guide for CVE-2024-38018 to identify the correct update for each deployed SharePoint edition and build. After installing binaries, run the SharePoint Products Configuration Wizard or psconfig on every server to complete database and farm upgrade actions. Ensure all web front ends, application servers, and search/workflow-related SharePoint roles are patched consistently. If immediate patching is not possible, restrict SharePoint access to trusted networks or VPN, enforce MFA for SharePoint users and administrators, remove unnecessary external exposure, monitor for suspicious child processes from SharePoint worker processes, and consider temporarily disabling high-risk customizations or upload/workflow features until patching is complete.

How to confirm the fix worked

Confirm that every SharePoint server reports a build number at or above the Microsoft fixed build for this vulnerability. Validate both Windows update installation and SharePoint farm upgrade completion; installing the package without completing the SharePoint configuration step may leave the farm partially remediated. Check Central Administration, SharePoint Management Shell, Windows installed update inventory, and farm health status for missing or pending updates. Review load balancers and DNS to ensure no unpatched SharePoint nodes remain in rotation. Where possible, perform an authenticated vulnerability scan or configuration assessment that checks SharePoint build levels rather than relying only on banner detection.

Typical attack path

1. Scan for externally reachable or internally accessible Microsoft SharePoint Server instances.
2. Identify version/build information or infer patch level from exposed SharePoint behavior and headers.
3. Obtain any required authenticated access, commonly through stolen, guessed, or phished credentials.
4. Send crafted requests to the vulnerable SharePoint endpoint or feature to trigger remote code execution.
5. Execute commands under the SharePoint application pool or service account context.
6. Stage tools or a web shell in writable SharePoint-related directories.
7. Collect SharePoint configuration data, documents, credentials, tokens, and service account material.
8. Pivot to databases, file shares, Active Directory, or other internal services using the compromised server as a trusted foothold.

How to detect it

To determine whether exploitation already occurred, review IIS access logs for unusual SharePoint requests followed by server errors, abnormal POST activity, or access to newly created ASPX files. Examine SharePoint ULS logs for unexpected exceptions, unsafe deserialization or request-processing errors, feature activation anomalies, upload-related errors, and requests tied to unusual users or source IPs. Review Windows Security logs, Sysmon, PowerShell logs, and EDR telemetry for SharePoint worker processes spawning command interpreters, scripting engines, LOLBins, archive tools, or network utilities. Check file system artifacts for recently created or modified ASPX, ASHX, config, DLL, or script files under SharePoint web roots and the SharePoint hive. Investigate unexpected scheduled tasks, new local users, modified service configurations, credential dumping tools, outbound connections from SharePoint servers, and authentication from SharePoint service accounts to unusual systems. Because no exploit-specific public IOC was supplied, detections should focus on behavioral evidence of RCE and post-exploitation from SharePoint processes.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> curl.exe
• w3wp.exe -> wget.exe
• OWSTIMER.EXE -> cmd.exe
• OWSTIMER.EXE -> powershell.exe
• C:\inetpub\wwwroot\wss\VirtualDirectories\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\
• *.aspx
• *.ashx
• -enc
• -EncodedCommand
• /c powershell
• Invoke-WebRequest
• IEX
• DownloadString

What your security team should do

• Prioritize patching any internet-facing SharePoint Server immediately, followed by internal farms that host sensitive data or use privileged service accounts.
• Inventory all SharePoint servers, including web front ends, application servers, disaster recovery nodes, and legacy farms that may not be in standard patch workflows.
• Verify that the SharePoint Products Configuration Wizard or psconfig completed successfully after update installation on every server.
• Hunt for suspicious process creation where w3wp.exe, OWSTIMER.EXE, or SharePoint service processes spawn command shells, scripting engines, or download utilities.
• Review IIS, SharePoint ULS, Windows Security, PowerShell, Sysmon, and EDR telemetry for anomalous requests, file writes, and post-exploitation behavior around the publication date and any suspected exposure window.
• Restrict direct internet access to SharePoint where possible and require MFA, conditional access, and least privilege for all users and administrators.
• Rotate credentials for SharePoint service accounts and review their privileges if exploitation is suspected.
• Add detections for web shell placement in SharePoint directories and unexpected ASPX file creation or modification.