CVE-2024-38023

What it actually does

This vulnerability is a Microsoft SharePoint Server remote code execution flaw in the deserialization class of issues. An attacker with high privileges can submit a crafted request or payload that causes SharePoint to deserialize attacker-controlled data and execute code on the server. Successful exploitation can provide code execution in the context of the SharePoint web application pool, service account, or another SharePoint server-side process, potentially allowing access to SharePoint content databases, configuration secrets, files, credentials, and connected internal resources. The supplied package list and fixed versions reference Debian/Ubuntu Linux kernel packages, which appear inconsistent with the SharePoint Server vulnerability description and should be validated before being used for remediation decisions.

Why it matters to the business

Compromise of a SharePoint server can expose sensitive documents, internal workflows, authentication material, and business records, and can also give attackers a foothold for broader Windows domain compromise. Because SharePoint is commonly integrated with identity, email, Office documents, and internal collaboration processes, exploitation can lead to data theft, service disruption, ransomware staging, and loss of trust in shared content. The EPSS score is elevated, indicating meaningful likelihood of exploitation activity even though this issue is not currently listed in CISA KEV and is not marked as known ransomware-used. Since the issue was published more than two years ago, unpatched systems should be treated as significantly overdue.

How an attack unfolds

An attacker first obtains or abuses a highly privileged SharePoint account, which is required by the CVSS privilege requirement. The attacker then reaches the SharePoint web application over the network and sends a specially crafted request that targets a vulnerable server-side deserialization path. If the server accepts and processes the payload, attacker-controlled serialized data is deserialized and results in execution of arbitrary commands or code on the SharePoint server. After code execution, the attacker commonly attempts to enumerate SharePoint configuration, extract credentials or secrets, access document libraries and content databases, deploy web shells or persistence mechanisms, and pivot to other internal systems using the SharePoint server's network reachability and service account privileges.

How to fix it

Apply the relevant Microsoft SharePoint Server security updates from the July 2024 Microsoft security release or later cumulative updates for the installed SharePoint version. Prioritize internet-facing SharePoint servers, farms that process sensitive data, and servers where highly privileged SharePoint accounts are used interactively. Restrict administrative and high-privilege SharePoint access to trusted administrative workstations and management networks. Enforce MFA and phishing-resistant authentication for privileged accounts. Review and minimize SharePoint farm, service account, and site collection administrator privileges. Ensure antimalware exclusions for SharePoint do not create blind spots for web shells or dropped executables. If the provided asset data maps this CVE to Debian/Ubuntu Linux packages, validate the mapping because those fixed versions appear unrelated to the SharePoint vulnerability; do not consider Linux kernel updates alone sufficient to remediate a SharePoint Server RCE. If those Linux packages are independently in scope for a different issue, update to the listed versions or later: Debian 11 linux 5.10.70-1, Debian 12/13 linux 5.14.6-1, Ubuntu 20.04 linux-aws-5.15 5.15.0-1014.18~20.04.1, linux-azure-5.15 5.15.0-1007.8~20.04.1, linux-azure-fde-5.15 5.15.0-1019.24~20.04.1.1, linux-gcp-5.15 5.15.0-1006.9~20.04.1, linux-gkeop-5.15 5.15.0-1003.5~20.04.2, linux-hwe-5.15 5.15.0-33.34~20.04.1, linux-ibm-5.15 5.15.0-1033.36~20.04.1, linux-intel-iotg-5.15 5.15.0-1003.5~20.04.1, linux-iot 5.4.0-1001.3, linux-lowlatency-hwe-5.15 5.15.0-33.34~20.04.1, linux-oracle-5.15 5.15.0-1007.9~20.04.1, linux-riscv-5.15 5.15.0-1015.17~20.04.1, linux-xilinx-zynqmp 5.4.0-1020.24, Ubuntu 22.04 linux 5.13.0-19.19, linux-aws 5.13.0-1005.6, linux-aws-6.5 6.5.0-1008.8~22.04.1, linux-azure 5.13.0-1006.7, linux-azure-6.5 6.5.0-1007.7~22.04.1, and linux-azure-fde 5.15.0-1019.24.1.

How to confirm the fix worked

Confirm the installed SharePoint build level on every SharePoint server in the farm and verify that the July 2024 security update or a later cumulative update applicable to that SharePoint version is installed. Use Microsoft update inventory, SharePoint Central Administration, PowerShell-based farm inventory, and endpoint management data to compare installed builds against Microsoft's fixed build guidance. Validate that all servers in the farm, including application, web front-end, search, and workflow-related servers, are patched consistently. Reboot where required and confirm SharePoint services return to a healthy state. For exposure validation, identify SharePoint endpoints reachable from the internet or untrusted networks and confirm administrative interfaces are not broadly accessible. Also review vulnerability scanner findings for product-mapping errors: Linux kernel package versions should not be used as proof that a Microsoft SharePoint Server vulnerability is fixed.

Typical attack path

1. Identify an internet-facing or internally reachable Microsoft SharePoint Server instance.
2. Obtain or compromise a highly privileged SharePoint account through phishing, credential theft, password reuse, token theft, or prior intrusion activity.
3. Confirm the SharePoint version and patch level are vulnerable.
4. Send a crafted authenticated request containing malicious serialized data to a vulnerable SharePoint component.
5. Trigger unsafe deserialization and achieve server-side code execution.
6. Execute reconnaissance commands from the SharePoint process context.
7. Access SharePoint configuration, content, credentials, tokens, or connected databases.
8. Deploy persistence such as a web shell, scheduled task, service, malicious script, or modified SharePoint artifact.
9. Use the compromised SharePoint server to move laterally, stage tools, exfiltrate data, or disrupt services.

How to detect it

Investigate whether exploitation occurred by correlating SharePoint ULS logs, IIS W3C access logs, Windows Security logs, PowerShell logs, Sysmon or EDR telemetry, antivirus alerts, and file-system change events on SharePoint servers. Focus on authenticated requests by privileged users followed by abnormal server-side behavior, especially w3wp.exe, OWSTIMER.EXE, or SharePoint service processes launching command shells, PowerShell, scripting engines, archive tools, network utilities, or unknown executables. Review IIS logs for unusual POST requests to SharePoint application pages, administrative paths, _layouts/15 endpoints, client.svc, or other endpoints shortly before process creation events. Examine SharePoint web directories for newly created or modified ASPX, ASHX, ASCX, DLL, config, JavaScript, PowerShell, or executable files. Hunt for web shell behavior such as requests with command parameters, repeated 200 responses to rare files, small uploaded script files, and outbound connections from SharePoint servers to unfamiliar hosts. Review Windows event logs for new services, scheduled tasks, local administrator changes, credential access, LSASS access, suspicious logons, and use of living-off-the-land binaries. Because exploitation requires high privileges, investigate privileged account compromise as part of the same incident path.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> curl.exe
• w3wp.exe -> wget.exe
• OWSTIMER.EXE -> cmd.exe
• OWSTIMER.EXE -> powershell.exe
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\*.aspx
• C:\inetpub\wwwroot\wss\VirtualDirectories\
• _layouts/15/
• /_vti_bin/client.svc
• POST /_layouts/15/
• POST /_vti_bin/client.svc
• System.Management.Automation
• -EncodedCommand
• FromBase64String
• Invoke-WebRequest
• Invoke-Expression
• DownloadString
• Add-MpPreference
• Set-MpPreference
• procdump.exe
• rundll32.exe comsvcs.dll, MiniDump
• Event ID 4688
• Event ID 7045
• Event ID 4698
• Microsoft-Windows-PowerShell/Operational Event ID 4104

What your security team should do

• Treat unpatched SharePoint servers as high-priority remediation targets because the issue is old, remotely reachable, high-impact, and has a notable EPSS score.
• Patch all SharePoint servers in each farm to the applicable Microsoft security update or later cumulative update, ensuring build consistency across the farm.
• Validate whether the listed Debian/Ubuntu Linux affected products are a data-enrichment mismatch before closing remediation work for SharePoint assets.
• Audit highly privileged SharePoint accounts for recent suspicious activity, unexpected logons, new administrators, privilege changes, and unusual access patterns.
• Restrict SharePoint administration to hardened admin workstations and trusted network ranges.
• Enable or tune detections for SharePoint worker processes spawning command shells, scripting engines, or network utilities.
• Review SharePoint web roots and layouts directories for newly created or recently modified ASPX, ASHX, DLL, EXE, PS1, and script files.
• Collect and retain IIS, SharePoint ULS, Windows Security, PowerShell, Sysmon or EDR telemetry long enough to cover the period before patching.
• Rotate credentials and secrets used by SharePoint service accounts if compromise is suspected.
• Perform threat hunting for post-exploitation behavior such as web shells, credential dumping, lateral movement, and data staging on SharePoint servers.