CVE-2022-35823: SharePoint Enterprise Server RCE Vulnerability

CVE-2022-35823 Overview

CVE-2022-35823 is a remote code execution vulnerability affecting multiple versions of Microsoft SharePoint Server. An authenticated attacker with low privileges can execute arbitrary code in the context of the SharePoint application by sending specially crafted requests over the network. Microsoft published this advisory on September 13, 2022, and the flaw impacts SharePoint Server 2013 SP1, 2016, 2019, and SharePoint Server Subscription Edition. The vulnerability carries a CVSS 3.1 base score of 8.8 and an EPSS probability of 38.4%, placing it in the 97th percentile for likelihood of exploitation.

Critical Impact
An authenticated attacker can achieve remote code execution on SharePoint servers, leading to data theft, lateral movement, and full compromise of collaboration infrastructure.

Affected Products

Microsoft SharePoint Enterprise Server 2013 SP1 and 2016
Microsoft SharePoint Foundation 2013 SP1
Microsoft SharePoint Server 2019 and Subscription Edition

Discovery Timeline

2022-09-13 - CVE-2022-35823 published to NVD and Microsoft Security Response Center advisory released
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-35823

Vulnerability Analysis

The vulnerability allows remote code execution within Microsoft SharePoint Server, a widely deployed enterprise collaboration platform. Microsoft's advisory classifies the flaw as a network-exploitable issue requiring authenticated access with low privileges. Successful exploitation grants the attacker the ability to run arbitrary code in the context of the SharePoint worker process, typically the application pool identity.

SharePoint servers commonly hold sensitive corporate documents, integrate with Active Directory, and host custom business workflows. Code execution on these servers exposes confidentiality, integrity, and availability of large volumes of organizational data. The high EPSS percentile indicates active interest from threat actors in SharePoint server-side vulnerabilities.

Root Cause

Microsoft has not published the underlying CWE category, and the NVD entry lists NVD-CWE-noinfo. SharePoint RCE vulnerabilities of this class historically involve unsafe deserialization, insufficient input validation in server-side handlers, or workflow processing flaws that permit attacker-controlled code paths. Refer to the Microsoft CVE-2022-35823 Advisory for vendor-confirmed technical details.

Attack Vector

The attack is launched over the network against a reachable SharePoint endpoint. The attacker must hold valid SharePoint credentials with low privileges, such as a standard authenticated user account. No user interaction is required, and the scope remains unchanged. Once authenticated, the attacker submits a crafted request to the vulnerable component to trigger code execution under the SharePoint application pool account.

No public proof-of-concept or exploit code is listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Detection Methods for CVE-2022-35823

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe running under the SharePoint application pool identity, such as cmd.exe, powershell.exe, or csc.exe.
New or modified .aspx, .ashx, or .asmx files in SharePoint web root directories that may indicate webshell deployment.
Outbound network connections from SharePoint servers to unrecognized external hosts following anomalous authenticated requests.

Detection Strategies

Monitor SharePoint ULS logs and IIS access logs for repeated authenticated POST requests to administrative or workflow endpoints from a single user account.
Correlate authentication events with subsequent process creation events on SharePoint servers to identify post-authentication code execution.
Hunt for serialization payload patterns, encoded .NET BinaryFormatter blobs, or unusually large request bodies sent to SharePoint handlers.

Monitoring Recommendations

Enable Windows command-line auditing (Event ID 4688) and PowerShell ScriptBlock logging on all SharePoint servers.
Forward IIS, ULS, and Windows Security logs to a centralized analytics platform for retention and correlation.
Baseline normal SharePoint application pool process behavior and alert on deviations such as child process creation or shell activity.

How to Mitigate CVE-2022-35823

Immediate Actions Required

Apply the September 2022 Microsoft security updates for all affected SharePoint Server versions as published in the Microsoft CVE-2022-35823 Advisory.
Audit SharePoint user accounts and revoke unnecessary authenticated access to reduce the population of accounts capable of triggering exploitation.
Review SharePoint servers for unauthorized files, scheduled tasks, and new local accounts that may indicate prior compromise.

Patch Information

Microsoft released cumulative security updates addressing CVE-2022-35823 on September 13, 2022. Administrators must install the relevant update for SharePoint Server 2013 SP1, SharePoint Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition. Refer to the Microsoft Security Response Center advisory for KB article numbers and download links specific to each product version.

Workarounds

Restrict SharePoint access to trusted network segments using firewall rules or reverse proxy authentication to limit exposure of authenticated endpoints.
Enforce multi-factor authentication on all SharePoint user accounts to reduce the risk of credential abuse leading to exploitation.
Disable unused SharePoint features, custom workflows, and server-side scripting capabilities where business requirements allow.

bash

# Configuration example: verify SharePoint patch level via PowerShell
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches