CVE-2024-32987: SharePoint Server Disclosure Vulnerability

CVE-2024-32987 Overview

CVE-2024-32987 is an information disclosure vulnerability in Microsoft SharePoint Server. The flaw is classified as Server-Side Request Forgery [CWE-918], allowing a remote unauthenticated attacker to coerce the SharePoint server into issuing requests that expose sensitive information. Microsoft published the advisory on July 9, 2024. The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Exploitation requires network access but no privileges or user interaction, resulting in high confidentiality impact with no direct effect on integrity or availability.

Critical Impact
A remote unauthenticated attacker can trigger server-side requests from SharePoint to disclose sensitive information from internal resources.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2024-07-09 - CVE-2024-32987 published to NVD and Microsoft advisory released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32987

Vulnerability Analysis

CVE-2024-32987 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft SharePoint Server. An attacker sends crafted requests to the SharePoint web front end. The server then issues outbound requests on the attacker's behalf. These requests can reach internal systems normally unreachable from the public network. The response data returned to the attacker can include sensitive information such as internal service metadata, configuration data, or content from adjacent applications. The Common Vulnerability Scoring System vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a network-reachable, unauthenticated attack that impacts confidentiality only. The Exploit Prediction Scoring System (EPSS) probability is 2.36% at the 81st percentile, indicating elevated likelihood of exploitation attempts compared to the average CVE. Microsoft has not designated the issue as exploited in the wild, and CISA has not added it to the Known Exploited Vulnerabilities catalog.

Root Cause

The vulnerability stems from improper validation of user-controlled URLs or resource identifiers processed by SharePoint server-side components [CWE-918]. The server fetches content from the supplied location without adequately restricting the destination, allowing requests to internal hosts, cloud metadata endpoints, or loopback services.

Attack Vector

The attack vector is network-based. An unauthenticated attacker submits a request to a vulnerable SharePoint endpoint containing a controlled URL. SharePoint executes the outbound fetch under its own identity and returns response data that the attacker can observe. No user interaction is required. Specific request details have not been publicly disclosed by Microsoft. Refer to the Microsoft CVE-2024-32987 Advisory for authoritative technical guidance.

Detection Methods for CVE-2024-32987

Indicators of Compromise

Unexpected outbound HTTP or HTTPS connections originating from SharePoint web front-end servers to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
IIS access logs on SharePoint servers showing anomalous requests to endpoints that accept URL parameters from unauthenticated clients.
Spikes in DNS resolution requests from SharePoint hosts for internal hostnames not tied to normal SharePoint operation.

Detection Strategies

Monitor SharePoint IIS logs for POST or GET requests containing URL-shaped parameters from unauthenticated sessions.
Correlate SharePoint process network telemetry with destination addresses in RFC1918 space, link-local ranges, or cloud metadata services.
Deploy web application firewall rules that flag requests containing embedded URLs targeting internal or loopback destinations.

Monitoring Recommendations

Enable verbose IIS request logging on SharePoint front-end servers and forward logs to a centralized analytics platform for retention and search.
Alert on outbound connections from w3wp.exe hosting SharePoint application pools to destinations outside expected patterns.
Track authentication anomalies and unauthenticated access to SharePoint web services during and after patch deployment windows.

How to Mitigate CVE-2024-32987

Immediate Actions Required

Apply the Microsoft security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 as documented in the Microsoft CVE-2024-32987 Advisory.
Inventory all SharePoint Server deployments and confirm patch level after installation using Get-SPFarm and product version checks.
Restrict outbound network access from SharePoint servers to only required destinations to limit SSRF impact until patches are applied.

Patch Information

Microsoft released security updates addressing CVE-2024-32987 on July 9, 2024. Administrators should install the July 2024 SharePoint security updates via Microsoft Update, WSUS, or the Microsoft Update Catalog. Consult the Microsoft CVE-2024-32987 Advisory for KB article numbers matching each SharePoint edition.

Workarounds

Segment SharePoint servers so they cannot initiate connections to internal management interfaces, cloud metadata endpoints, or sensitive internal services.
Place SharePoint web front ends behind a reverse proxy or web application firewall configured to inspect and block requests containing internal URLs or metadata addresses.
Enforce egress filtering at the host firewall to deny outbound traffic from SharePoint application pool processes to non-approved destinations.

bash

# Example egress restriction using Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Block SharePoint SSRF to Metadata" `
  -Direction Outbound `
  -Action Block `
  -RemoteAddress 169.254.169.254 `
  -Program "%SystemRoot%\System32\inetsrv\w3wp.exe"