CVE-2024-38094

What it actually does

CVE-2024-38094 is a Microsoft SharePoint remote code execution vulnerability associated with unsafe deserialization. An attacker with high privileges in SharePoint can send crafted data to a vulnerable SharePoint server and cause the server to deserialize attacker-controlled content, resulting in execution of arbitrary code in the context of the SharePoint application/service account. Successful exploitation can provide full confidentiality, integrity, and availability impact on the SharePoint server and may enable lateral movement to connected services, content databases, file shares, and identity infrastructure depending on service-account permissions.

Why it matters to the business

A compromised SharePoint server can expose sensitive documents, allow tampering with collaboration content and workflows, interrupt business operations, and become a foothold for broader domain compromise or ransomware deployment. This issue is listed in CISA KEV, is reported as actively exploited in the wild, has ransomware association, and had a CISA remediation due date of 2024-11-12, so unpatched internet-facing or broadly accessible SharePoint deployments should be treated as high-priority incident-risk systems despite the vulnerability requiring elevated SharePoint privileges.

How an attack unfolds

An attacker first obtains or abuses a high-privilege SharePoint account, such as a site owner or administrative role, through credential theft, phishing, session hijacking, password reuse, or prior compromise. The attacker then authenticates to the vulnerable SharePoint instance and submits a specially crafted request or payload to functionality that processes serialized data. The vulnerable server deserializes the attacker-controlled object and executes attacker-controlled code under the SharePoint worker process or service-account context. From there, the attacker may deploy a web shell, run PowerShell or command-line tooling, dump configuration secrets, access SharePoint content databases, create persistence through scheduled tasks or modified SharePoint artifacts, and move laterally. Because this vulnerability is in CISA KEV and associated with ransomware activity, post-exploitation should be assumed to include credential theft, data staging, backup discovery, and ransomware preparation unless proven otherwise.

How to fix it

Apply the Microsoft security updates that address CVE-2024-38094 on all SharePoint servers in every farm, including front-end, application, search, and distributed-cache roles where applicable. After installing SharePoint updates, run the SharePoint Products Configuration Wizard or equivalent PSConfig process on every server to complete database and farm configuration changes. Patch all servers in the farm to a consistent supported build; do not leave partially updated farms. Restrict SharePoint administrative and site-owner privileges to the minimum required users, enforce MFA for privileged access, and review service-account permissions. Limit SharePoint exposure to trusted networks or place it behind strong access controls where possible. If the provided package inventory includes Debian 11 Linux kernel packages, update those packages to linux 5.10.205-1 where applicable; however, validate product applicability because a Debian Linux kernel update does not remediate a Microsoft SharePoint vulnerability. For systems that cannot be immediately patched, reduce exposure, disable unnecessary SharePoint features, monitor aggressively for exploitation, and consider taking high-risk servers offline until remediation is complete.

How to confirm the fix worked

Confirm the installed SharePoint build numbers on every farm member against Microsoft’s fixed build guidance for the relevant SharePoint version and ensure PSConfig completed successfully after patching. Verify that all farm servers report the same expected patch level and that SharePoint Central Administration does not show upgrade-required or patch-mismatch status. Test authenticated SharePoint functionality after remediation to ensure farm health. Review vulnerability scanner results, Microsoft Update/WSUS/Intune/SCCM compliance data, and server inventory to confirm no vulnerable SharePoint nodes remain. For any Debian 11 Linux assets present in inventory, confirm the linux package version is at least 5.10.205-1 if that package is in scope, while separately validating SharePoint-specific remediation on Windows SharePoint servers.

Typical attack path

1. Acquire or compromise a high-privilege SharePoint user account.
2. Identify a vulnerable SharePoint server or farm that has not received the relevant Microsoft security updates.
3. Authenticate to SharePoint and send a crafted deserialization payload to the vulnerable component.
4. Achieve code execution in the SharePoint application/service-account context.
5. Spawn operating-system commands through the SharePoint worker process, commonly via cmd.exe, powershell.exe, or similar tooling.
6. Deploy persistence such as a web shell, scheduled task, modified SharePoint component, or additional privileged account.
7. Harvest SharePoint content, configuration files, database connection details, credentials, and authentication material.
8. Move laterally to SQL Server, Active Directory, file shares, backup systems, or management hosts.
9. Stage or exfiltrate data and, in ransomware scenarios, disable defenses and deploy encryption payloads.

How to detect it

Review IIS logs, SharePoint ULS logs, Windows Security logs, PowerShell logs, Sysmon/EDR telemetry, antivirus alerts, SQL Server access logs, and network proxy/firewall logs for activity from the exposure period. Focus on authenticated requests by privileged SharePoint users followed by errors, unusual SharePoint endpoints, file writes under SharePoint web directories, new or modified ASPX files, and child processes spawned by w3wp.exe. Investigate any w3wp.exe process launching cmd.exe, powershell.exe, pwsh.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, net.exe, nltest.exe, whoami.exe, or archive tools. Search for web shells and unexpected files in SharePoint layouts, hive, virtual directory, and inetpub paths. Correlate suspicious SharePoint requests with privileged-account logons, new admin or site-owner assignments, service-account authentication to unusual hosts, database access spikes, large file downloads, outbound connections to unknown infrastructure, and ransomware precursors such as backup deletion, shadow-copy deletion, endpoint-defense tampering, and mass file rename/write activity. Because exploitation requires high privileges, also examine identity-provider, VPN, and endpoint logs for credential theft or session hijacking preceding the SharePoint activity.

• w3wp.exe
• powershell.exe
• pwsh.exe
• cmd.exe
• mshta.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe
• bitsadmin.exe
• curl.exe
• wget.exe
• nltest.exe
• whoami.exe
• vssadmin.exe Delete Shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled No
• wevtutil.exe cl
• C:\inetpub\wwwroot\wss\VirtualDirectories\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\LOGS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS\
• C:\inetpub\logs\LogFiles\
• /_layouts/15/
• /_layouts/16/
• .aspx
• POST /_layouts/
• User-Agent: curl
• User-Agent: wget
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe

What your security team should do

• Treat unpatched SharePoint servers as urgent because the vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Immediately inventory all SharePoint farms, internet-facing SharePoint endpoints, and servers reachable by partner or VPN users.
• Apply the relevant Microsoft SharePoint security updates and run PSConfig on every farm member.
• Hunt for prior compromise before or during patching, especially if the server was exposed before the 2024-11-12 KEV due date.
• Review privileged SharePoint accounts, site owners, farm administrators, and service accounts for suspicious changes or unexpected membership.
• Rotate credentials and secrets accessible to SharePoint service accounts if exploitation is suspected.
• Monitor for SharePoint worker processes spawning shells, scripting engines, archive tools, download utilities, or credential-dumping tools.
• Restrict administrative access to SharePoint, enforce MFA, and remove stale high-privilege accounts.
• Ensure SharePoint, IIS, Windows Security, PowerShell, EDR, and SQL Server logs are retained long enough to cover the exposure window.
• Prepare incident response actions for web-shell discovery, lateral movement, data theft, and ransomware staging if indicators are found.