CVE-2024-30043: SharePoint Server Information Disclosure

CVE-2024-30043 Overview

CVE-2024-30043 is an information disclosure vulnerability in Microsoft SharePoint Server caused by improper restriction of XML External Entity (XXE) references [CWE-611]. A remote, unauthenticated attacker can send a crafted XML payload to a vulnerable SharePoint endpoint and force the server to parse external entities. Successful exploitation discloses sensitive file contents and internal data accessible to the SharePoint service account. Microsoft published the advisory on May 14, 2024 as part of its monthly security update cycle. The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.

Critical Impact
Unauthenticated network attackers can read sensitive files and internal resources from affected SharePoint Server instances using crafted XML payloads, with an EPSS score placing this CVE in the 98th percentile for exploitation likelihood.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 (Enterprise)

Discovery Timeline

2024-05-14 - Microsoft releases security patch and publishes advisory
2024-05-14 - CVE-2024-30043 published to NVD
2025-01-08 - Last updated in NVD database

Technical Details for CVE-2024-30043

Vulnerability Analysis

The vulnerability stems from improper restriction of XML External Entity references during XML parsing in SharePoint Server components. SharePoint accepts XML input from network clients without disabling external entity resolution in the underlying parser. An attacker submits an XML document containing an external entity declaration that references a local file URI or an internal HTTP resource. The XML parser dereferences the entity and embeds the retrieved content into the response or processing context.

The impact is confidentiality-only. Integrity and availability remain unaffected because the attacker reads data rather than modifying server state. Attackers commonly use XXE flaws to read configuration files, web.config secrets, service account tokens, and internal SharePoint farm metadata. The flaw can also enable Server-Side Request Forgery against resources reachable from the SharePoint server.

Root Cause

The root cause is an XML parser configured to resolve DOCTYPE declarations and external entities without restriction [CWE-611]. SharePoint deserialization paths fail to set XmlResolver to null or disable DtdProcessing before parsing untrusted input. This allows entity expansion to dereference file://, http://, or UNC paths during request handling.

Attack Vector

Exploitation requires only network access to a SharePoint endpoint that accepts XML. No authentication or user interaction is needed. The attacker crafts a SOAP, REST, or list-import request carrying a malicious <!DOCTYPE> block with an external entity declaration. When SharePoint parses the document, it resolves the entity and returns the referenced content in the response or via an out-of-band channel controlled by the attacker. Refer to the Microsoft Security Update Advisory for component-level details.

Detection Methods for CVE-2024-30043

Indicators of Compromise

Inbound HTTP POST requests to SharePoint endpoints containing <!DOCTYPE or <!ENTITY declarations in request bodies
Outbound connections from the SharePoint server process (w3wp.exe) to unexpected external hosts during XML processing
IIS logs showing XML or SOAP requests followed by anomalous file-read activity by the SharePoint application pool identity
Access attempts to local files such as web.config, hosts, or win.ini correlated with SharePoint worker process activity

Detection Strategies

Inspect HTTP request bodies destined for /. /_vti_bin/, /_api/, and /_layouts/ for XML DOCTYPE and ENTITY tokens
Alert on w3wp.exe reading sensitive system files outside its normal content directories
Monitor for SharePoint-originated DNS lookups or HTTP requests to non-SharePoint, non-Microsoft destinations
Deploy WAF signatures matching XXE patterns for SharePoint URL paths

Monitoring Recommendations

Enable verbose IIS request logging including request body sampling on SharePoint front-end servers
Correlate file-access auditing on the SharePoint server with timestamps of incoming XML requests
Track outbound network egress from SharePoint farms and baseline expected destinations
Review SharePoint ULS logs for XML parser exceptions and entity resolution warnings

How to Mitigate CVE-2024-30043

Immediate Actions Required

Apply the May 2024 Microsoft security update for SharePoint Server Subscription Edition, 2019, and 2016 without delay
Inventory all internet-facing SharePoint instances and prioritize patching given the EPSS score of 59.3%
Restrict network access to SharePoint administrative and API endpoints to trusted segments
Rotate credentials and secrets stored in web.config if exploitation is suspected

Patch Information

Microsoft published fixes through the May 14, 2024 Patch Tuesday release. Administrators should install the cumulative update referenced in the Microsoft Security Update Advisory for their specific SharePoint version. After patching, run the SharePoint Products Configuration Wizard or PSConfig.exe to complete the deployment across the farm.

Workarounds

Place a web application firewall in front of SharePoint and block requests containing <!DOCTYPE or <!ENTITY declarations
Restrict outbound network connectivity from SharePoint servers to deny out-of-band XXE data exfiltration
Limit access to SharePoint XML-accepting endpoints to authenticated internal users until the patch is applied
Audit and remove unused SharePoint web services and features that accept XML input

bash

# Configuration example: verify SharePoint build after patching
Get-SPFarm | Select BuildVersion
Get-SPProduct -Local | Select ProductName, PatchableUnitDisplayName, PatchVersion