The SharePoint flaw first exploited in the wild in May continues to be exploited nine months after it was patched by Microsoft.
On December 10, security researcher Kevin Beaumont published a tweet cautioning organizations to patch a Microsoft SharePoint flaw that’s been actively exploited in the wild since at least May, and has since remained a valuable asset to cybercriminals.
Analysis
CVE-2019-0604 is a remote code execution (RCE) vulnerability in Microsoft SharePoint due to improper input validation in checking the source markup of an application package. Successful exploitation of the vulnerability by an attacker would grant them arbitrary code execution “in the context of the SharePoint application pool and the SharePoint server farm account.” The vulnerability was reported by security researcher Markus Wulftange, who shared a detailed write-up on his discovery in a blog for the Zero Day Initiative on March 13.
On May 9, security researcher Chris Doman published a tweet stating the flaw was being exploited in the wild based on reports from the National Cyber Security Centre in Saudi Arabia and the Canadian Centre for Cyber Security.
On May 28, Palo Alto Networks published a blog identifying the use of this vulnerability in the wild in targeted attacks by a threat actor known as Emissary Panda.
Additionally, CloudFlare published a blog about the vulnerability on May 28. CloudFlare confirmed the flaw could be exploited pre-authentication because “there were paths which could be reached without authentication.” As a result, they disputed the NVD score of 8.8 for the vulnerability, recommending it receive a 9.8 instead. They also found that proof-of-concept (PoC) code for the vulnerability “did not work out of the box,” requiring “weaponisation by a more skilled adversary.”
On November 25, Beaumont modified his BlueKeep honeypots, “BluePot,” to support SharePoint. One day later, Beaumont confirmed “the attackers arrived.” He reiterated the CVSS score for the vulnerability was wrong and should be a 9.8 because “it works without authentication.” He issued an additional reminder on December 10 because the flaw is still being exploited in the wild and a “significant numbers of assets remain exposed.”
Proof of concept
Initially, there was a GitHub repository published containing PoC code for the vulnerability in May. However, that repository has since been removed. There is another PoC for the vulnerability that was published to a GitHub repository back in June and a write-up detailing the use of this PoC was published to GitHub in the last few days.
In September, security analyst Mansour Al-Saeedi published his analysis of the vulnerability based on the initial work by the Zero Day Initiative, demoing a quick PoC. Al-Saeedi also published a packet capture analysis of the RCE exploit being carried out along with Snort and Sigma rules to detect it to his GitHub repository.
Solution
Microsoft initially patched the vulnerability on February 12 during Patch Tuesday. However, that patch was apparently incomplete, as Microsoft issued a follow-up release on March 12 to “comprehensively address” the flaw.
The information contained in this website is for general information purposes only. The information is gathered from Tenable, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.