Microsoft SharePoint Enterprise Server Application Package unrestricted upload

Summaryinfo

A vulnerability was found in Microsoft SharePoint Enterprise Server. It has been classified as critical. This issue affects some unknown processing of the component Application Package Handler. The manipulation leads to unrestricted upload. This vulnerability is traded as CVE-2020-0932. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in Microsoft SharePoint Enterprise Server (Groupware Software) (unknown version). It has been rated as critical. This issue affects an unknown code block of the component Application Package Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0971, CVE-2020-0974.

The weakness was shared 04/14/2020 as confirmed security update guide (Website). It is possible to read the advisory at portal.msrc.microsoft.com. The vendor cooperated in the coordination of the public release. The identification of this vulnerability is CVE-2020-0932. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK. The advisory points out:

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Microsoft

Name

• SharePoint Enterprise Server

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion