CVE-2024-43464: SharePoint Server RCE Vulnerability

CVE-2024-43464 Overview

CVE-2024-43464 is a remote code execution vulnerability in Microsoft SharePoint Server. The flaw is rooted in insecure deserialization of untrusted data [CWE-502], allowing an authenticated attacker with elevated privileges to run arbitrary code on the SharePoint server. Microsoft published the advisory on September 10, 2024, and the issue affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. The CVSS 3.1 score is 7.2, and the EPSS probability of exploitation is approximately 36.3% (98.35th percentile), indicating high relative likelihood of exploitation activity.

Critical Impact
An attacker with Site Owner permissions can achieve full remote code execution on the SharePoint server, compromising confidentiality, integrity, and availability of hosted content and downstream systems.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 (Enterprise)

Discovery Timeline

2024-09-10 - CVE-2024-43464 published to the National Vulnerability Database
2024-09-10 - Microsoft releases security update addressing the vulnerability
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43464

Vulnerability Analysis

CVE-2024-43464 is an insecure deserialization vulnerability [CWE-502] in Microsoft SharePoint Server. SharePoint processes serialized objects supplied within authenticated requests. When the server deserializes attacker-controlled data without validating the object graph, it instantiates types that trigger code execution during reconstruction. The result is remote code execution in the context of the SharePoint application pool identity, typically a privileged service account with access to configuration data, content databases, and integrated services.

Root Cause

The root cause is the acceptance and deserialization of untrusted serialized payloads without type filtering or integrity checks. .NET deserialization gadgets present in the SharePoint runtime allow the payload to chain method calls that execute arbitrary commands. Microsoft classifies the flaw under CWE-502, confirming that the deserialization pipeline is the point of failure rather than a parser or memory corruption defect.

Attack Vector

The attack vector is network-based and requires an authenticated user holding Site Owner privileges on a target SharePoint site. The attacker crafts a malicious serialized object and submits it to a vulnerable SharePoint endpoint that accepts serialized input. No user interaction is required, and the attack complexity is low. Because SharePoint frequently integrates with Active Directory, file shares, and business systems, successful exploitation can be used as a pivot for lateral movement.

No verified public proof-of-concept code is available at this time. Refer to the Microsoft Security Update Guide for CVE-2024-43464 for authoritative technical details.

Detection Methods for CVE-2024-43464

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe hosting the SharePoint application pool, particularly cmd.exe, powershell.exe, or csc.exe.
New or modified files under SharePoint web application directories, especially .aspx, .ashx, or DLL files written by the application pool identity.
POST requests to SharePoint endpoints containing base64-encoded serialized .NET payloads or TypeConfuseDelegate and ObjectDataProvider gadget markers.
Outbound network connections initiated by SharePoint worker processes to non-corporate destinations.

Detection Strategies

Hunt for w3wp.exe process trees that launch scripting or compilation binaries, which is atypical for normal SharePoint operation.
Inspect IIS logs for authenticated POST requests to SharePoint handlers correlated with process anomalies on the server.
Alert on writes to LAYOUTS, _catalogs, or _vti_bin paths that originate from the SharePoint service account outside of scheduled updates.

Monitoring Recommendations

Ingest IIS, Windows Security, and Sysmon telemetry from SharePoint front-end and application servers into a centralized analytics platform for correlated review.
Monitor privileged SharePoint role assignments and audit changes to Site Owner membership, since exploitation requires that privilege level.
Track outbound connections from SharePoint servers and baseline expected destinations to surface command-and-control traffic quickly.

How to Mitigate CVE-2024-43464

Immediate Actions Required

Apply the September 2024 SharePoint security updates for Subscription Edition, 2019, and 2016 as documented in the Microsoft advisory.
Inventory all SharePoint deployments, including farm servers and standalone installations, and confirm patch level on each.
Review Site Owner and site collection administrator memberships and remove accounts that do not require elevated privileges.
Rotate credentials and service account passwords on any SharePoint server that cannot be immediately verified as patched.

Patch Information

Microsoft released security updates for CVE-2024-43464 on September 10, 2024. Administrators should install the updates referenced in the Microsoft Security Update Guide for CVE-2024-43464. Apply the update for each SharePoint version present in the environment and restart the affected servers to complete installation.

Workarounds

Restrict Site Owner permissions to a minimal set of trusted administrators until patching is complete.
Place SharePoint servers behind a web application firewall configured to inspect and block serialized .NET payloads in request bodies.
Segment SharePoint servers from sensitive internal systems to limit blast radius if exploitation occurs.
Disable custom script execution on sites where it is not required to reduce available attack surface.

bash

# Verify SharePoint patch level via PowerShell on the farm server
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct | Select-Object ProductName, PatchableUnitDisplayName, Patches