CVE-2024-43466: Microsoft SharePoint Server DoS Vulnerability

CVE-2024-43466 Overview

CVE-2024-43466 is a denial of service vulnerability affecting Microsoft SharePoint Server. The flaw is associated with deserialization of untrusted data [CWE-502] and can be triggered remotely over the network without authentication or user interaction. A successful attack causes high availability impact on the targeted SharePoint instance, disrupting collaboration services for all connected users. Microsoft assigned a CVSS 3.1 base score of 7.5 and rated the issue HIGH. The vulnerability impacts SharePoint Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. The EPSS score of 4.44% (90th percentile) indicates elevated likelihood of exploitation activity compared with the broader CVE population.

Critical Impact
Unauthenticated remote attackers can take SharePoint Server offline, disrupting document management, intranet portals, and downstream Microsoft 365 integrations.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2024-09-10 - Microsoft published advisory for CVE-2024-43466
2024-09-10 - CVE-2024-43466 published to NVD
2024-09-13 - Last updated in NVD database

Technical Details for CVE-2024-43466

Vulnerability Analysis

The vulnerability resides in how Microsoft SharePoint Server processes attacker-supplied serialized data. Improper handling during deserialization allows a remote, unauthenticated attacker to exhaust server resources or trigger an unhandled exception in a worker process. The resulting condition forces the SharePoint application pool or related services into an unresponsive state. Because the attack requires no privileges and no user interaction, any SharePoint endpoint reachable over the network is exposed. The confidentiality and integrity of stored content are not directly affected, but availability is fully impacted while the service is unreachable.

Root Cause

The root cause is tracked under [CWE-502: Deserialization of Untrusted Data]. SharePoint accepts and processes serialized objects from network requests without sufficient validation of object type, structure, or resource consumption. Processing the malicious payload drives the affected service into a denial of service state.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request containing malicious serialized data to a SharePoint web front-end. No authentication, elevated privileges, or user interaction is required. Refer to the Microsoft Security Response Center advisory for vendor-specific technical context.

No public proof-of-concept exploit, ExploitDB entry, or CISA Known Exploited Vulnerabilities listing has been recorded for this CVE at the time of writing.

Detection Methods for CVE-2024-43466

Indicators of Compromise

Repeated SharePoint application pool crashes or recycles in IIS logs without a corresponding configuration change.
Anomalous HTTP POST requests to SharePoint endpoints carrying large or malformed serialized payloads.
Spikes in 500-series HTTP response codes from /_layouts/ or /_vti_bin/ paths followed by service unavailability.

Detection Strategies

Inspect IIS and SharePoint ULS logs for unhandled exceptions originating from deserialization stack frames such as BinaryFormatter, LosFormatter, or ObjectStateFormatter.
Deploy WAF or IDS rules that flag inbound SharePoint requests containing base64-encoded .NET serialization headers (for example, the AAEAAAD/// marker).
Correlate worker process (w3wp.exe) crash events with inbound network sessions to identify the source of triggering traffic.

Monitoring Recommendations

Forward IIS, ULS, and Windows Application logs from all SharePoint servers to a centralized analytics platform for continuous review.
Alert on sudden drops in SharePoint availability metrics and on bursts of HTTP 5xx responses from front-end servers.
Track baseline request sizes to SharePoint endpoints and alert on outliers consistent with serialized object payloads.

How to Mitigate CVE-2024-43466

Immediate Actions Required

Apply the September 2024 Microsoft security updates for SharePoint Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 on all front-end and application servers.
Restrict external access to SharePoint front-ends behind a VPN, reverse proxy, or web application firewall while patching is staged.
Validate that SharePoint farm accounts and service accounts follow least privilege so that a service crash cannot be leveraged for lateral movement.

Patch Information

Microsoft has released security updates addressing CVE-2024-43466. Administrators should follow guidance in the Microsoft CVE-2024-43466 Advisory and install the appropriate cumulative update for each supported SharePoint Server version. After patching, restart the SPTimerV4 service and recycle SharePoint application pools to ensure updated assemblies are loaded.

Workarounds

Front SharePoint with a WAF configured to block requests containing .NET serialization signatures until patches are deployed.
Limit inbound traffic to SharePoint endpoints to trusted internal networks and authenticated VPN users.
Disable or tightly restrict anonymous access on SharePoint web applications and site collections.

bash

# Configuration example: verify installed SharePoint security update level
Get-SPProduct | Select-Object ProductName, PatchableUnitDisplayName, PatchVersion

# Recycle SharePoint web application pools after patch installation
Import-Module WebAdministration
Get-ChildItem IIS:\AppPools | Where-Object { $_.Name -like 'SharePoint*' } | ForEach-Object { Restart-WebAppPool $_.Name }