CVE-2024-30100: Microsoft SharePoint Server RCE Vulnerability

CVE-2024-30100 Overview

CVE-2024-30100 is a Remote Code Execution (RCE) vulnerability affecting Microsoft SharePoint Server. This vulnerability is classified under CWE-426 (Untrusted Search Path), indicating that the flaw involves improper handling of search paths which can be exploited by an attacker to execute arbitrary code on vulnerable systems.

The vulnerability requires local access and user interaction to exploit, meaning an attacker would need to convince a user to open a malicious file or trigger specific actions within SharePoint Server. Successful exploitation could allow an attacker to gain complete control over the affected system with high impact to confidentiality, integrity, and availability.

Critical Impact

Successful exploitation enables remote code execution on Microsoft SharePoint Server deployments, potentially compromising enterprise collaboration infrastructure and sensitive corporate data.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 Enterprise Edition

Discovery Timeline

• June 11, 2024 - CVE-2024-30100 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-30100

Vulnerability Analysis

This vulnerability stems from an Untrusted Search Path weakness (CWE-426) in Microsoft SharePoint Server. The flaw allows attackers to manipulate the search path used by the application when loading resources or executing code, potentially redirecting operations to attacker-controlled locations.

The attack requires local access, meaning the attacker must either have physical access to the system or have already established some level of access to the network where SharePoint is deployed. Additionally, user interaction is required for successful exploitation, such as opening a crafted document or clicking on a malicious link within the SharePoint environment.

The impact of successful exploitation is severe, affecting all three pillars of security: an attacker can access sensitive information (confidentiality), modify data or system configurations (integrity), and disrupt service availability (availability).

Root Cause

The root cause lies in how Microsoft SharePoint Server handles search paths during certain operations. The application fails to properly validate or restrict the locations from which it loads executable code or resources. This untrusted search path vulnerability (CWE-426) allows an attacker to place malicious files in locations that SharePoint will search before finding legitimate resources, resulting in the execution of attacker-controlled code.

Attack Vector

The attack vector is local with user interaction required. An attacker would need to:

1. Gain initial access to the network or system where SharePoint Server is deployed
2. Plant malicious files in strategic locations within the search path hierarchy
3. Entice a user to perform an action that triggers SharePoint to search for and execute the malicious payload

The exploitation requires social engineering or other techniques to convince users to interact with crafted content. Once triggered, the attacker-controlled code executes with the privileges of the SharePoint process, potentially allowing complete system compromise.

For detailed technical information about this vulnerability, refer to the Microsoft Security Advisory.

Detection Methods for CVE-2024-30100

Indicators of Compromise

• Unexpected DLL or executable files appearing in SharePoint installation directories or common search paths
• Unusual process execution chains originating from SharePoint Server processes
• Modified file system permissions on SharePoint-related directories
• Anomalous network connections initiated by SharePoint server processes

Detection Strategies

• Monitor SharePoint Server processes for loading unexpected modules or DLLs from non-standard locations
• Implement file integrity monitoring on SharePoint installation directories and system paths
• Enable Windows Event logging for process creation and DLL loading events on SharePoint servers
• Deploy endpoint detection and response (EDR) solutions to identify suspicious execution patterns

Monitoring Recommendations

• Configure SIEM rules to alert on process creation events involving SharePoint components with unusual parent-child relationships
• Monitor for changes to environment variables that could affect search path resolution
• Implement baseline monitoring of loaded modules in SharePoint processes to detect anomalies
• Review audit logs for user actions that may indicate exploitation attempts

How to Mitigate CVE-2024-30100

Immediate Actions Required

• Apply the security update from Microsoft immediately to all affected SharePoint Server installations
• Restrict local access to SharePoint servers to authorized administrators only
• Review and audit existing file permissions on SharePoint installation directories
• Implement application whitelisting to prevent unauthorized code execution

Patch Information

Microsoft has released security updates to address CVE-2024-30100. Administrators should apply patches for:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 Enterprise Edition

Refer to the Microsoft Security Response Center Advisory for specific patch details, update packages, and installation guidance.

Workarounds

• Restrict write access to directories within the SharePoint search path to prevent attackers from placing malicious files
• Implement strict group policies to control executable loading behavior on SharePoint servers
• Enable Windows Defender Application Control (WDAC) or AppLocker policies to restrict code execution
• Limit user permissions and enforce the principle of least privilege for SharePoint access

# Example: Audit SharePoint installation directories for suspicious files
Get-ChildItem -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions" -Recurse -Include *.dll,*.exe | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | Select-Object FullName, LastWriteTime