Microsoft SharePoint Server 2010 SP2/2013 SP1/2016/2019 Upload unrestricted upload

Summaryinfo

A vulnerability was found in Microsoft SharePoint Server 2010 SP2/2013 SP1/2016/2019. It has been declared as problematic. This impacts an unknown function of the component Upload Handler. Executing a manipulation can lead to unrestricted upload. This vulnerability is handled as CVE-2019-1443. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as problematic was found in Microsoft SharePoint Server 2010 SP2/2013 SP1/2016/2019 (Groupware Software). This vulnerability affects some unknown processing of the component Upload Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality. CVE summarizes:

An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'.

The weakness was released 11/12/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release was coordinated with the vendor. This vulnerability was named CVE-2019-1443. The exploitation appears to be easy. The attack can be initiated remotely. Required for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1608.002. The advisory points out:

An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entry connected to this vulnerability is available at VDB-145395. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Microsoft

Name

• SharePoint Server

Version

• 2010 SP2
• 2013 SP1
• 2016
• 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion