CVE-2024-49064: Microsoft SharePoint Information Disclosure

CVE-2024-49064 Overview

CVE-2024-49064 is an information disclosure vulnerability in Microsoft SharePoint Server. The flaw is classified as an XML External Entity (XXE) reference issue [CWE-611] and allows a network-based attacker to read sensitive information from a targeted SharePoint instance. Exploitation requires user interaction, and no privileges are needed on the target system. The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published the advisory on December 12, 2024, and issued security updates through its standard update-guide channel.

Critical Impact
A successful attack exposes confidential SharePoint content and internal server-side data to an unauthenticated attacker over the network.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2024-12-12 - CVE-2024-49064 published to NVD
2024-12-12 - Microsoft released security update for CVE-2024-49064
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49064

Vulnerability Analysis

CVE-2024-49064 is an XML External Entity (XXE) vulnerability in Microsoft SharePoint Server. SharePoint parses XML input during content and document processing workflows. When the underlying XML parser resolves external entity references without restriction, an attacker can craft an XML document that instructs the parser to fetch external resources or read local files.

The attack is network-based and requires user interaction, typically opening or uploading a specially crafted file to SharePoint. The impact is limited to confidentiality; the vulnerability does not modify data or affect service availability. Because SharePoint often stores sensitive corporate content, disclosure of configuration files, credentials, or internal URIs represents a meaningful risk to downstream systems.

Root Cause

The root cause is improper restriction of XML External Entity references [CWE-611] in SharePoint's XML parsing routines. The parser resolves DOCTYPE and ENTITY declarations that reference external content instead of rejecting or ignoring them. An attacker can define entities that point to file:// URIs or attacker-controlled HTTP endpoints, causing the SharePoint process to disclose the resolved content back to the attacker or transmit it out-of-band.

Attack Vector

An unauthenticated remote attacker delivers a malicious XML document to a SharePoint user. The user opens or processes the file within SharePoint, which triggers server-side XML parsing. The injected external entity references cause SharePoint to read files accessible to the service account or reach out to attacker-controlled infrastructure. Refer to the Microsoft Vulnerability Update CVE-2024-49064 for authoritative technical details.

Detection Methods for CVE-2024-49064

Indicators of Compromise

Outbound HTTP or DNS traffic from SharePoint servers to unfamiliar external hosts triggered by document processing.
Uploaded documents or list items containing XML payloads with <!DOCTYPE> or <!ENTITY> declarations referencing external URIs.
Unexpected access to local files such as web.config, machine.config, or hosts by the SharePoint worker process.

Detection Strategies

Inspect SharePoint upload traffic and file libraries for XML content containing external entity declarations, especially SYSTEM identifiers pointing to file:// or remote URLs.
Correlate IIS and SharePoint ULS logs with process-level network telemetry to identify w3wp.exe initiating unexpected outbound connections.
Alert on file-read operations against sensitive configuration paths performed by SharePoint service accounts outside of normal maintenance windows.

Monitoring Recommendations

Baseline outbound network flows from SharePoint front-end servers and alert on new destinations tied to XML parsing events.
Enable verbose logging for content processing pipelines that accept user-supplied XML, XSLT, or DOCX/OOXML files.
Forward SharePoint, IIS, and endpoint telemetry to a centralized data lake and apply detections for XXE indicators against ingested content.

How to Mitigate CVE-2024-49064

Immediate Actions Required

Apply the security update referenced in the Microsoft Vulnerability Update CVE-2024-49064 to all SharePoint Server 2016, 2019, and Subscription Edition instances.
Inventory SharePoint farms and confirm patch level on every Web Front End and Application server, including disaster recovery nodes.
Restrict document upload rights to authenticated, trusted users while patching is in progress.

Patch Information

Microsoft released fixed builds for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 through the December 2024 security update cycle. Consult the Microsoft Security Response Center advisory for the specific KB numbers and deployment guidance for each supported SharePoint version.

Workarounds

Block or filter uploads of XML, XSLT, and other structured document types at the network perimeter or web application firewall until patches are applied.
Restrict outbound network egress from SharePoint servers so that XXE payloads cannot reach attacker-controlled infrastructure.
Apply least-privilege permissions to the SharePoint service account to limit which files an XXE payload could read.

bash

# Configuration example: restrict outbound egress from SharePoint front-end servers
# Adjust to your environment before deploying.
New-NetFirewallRule -DisplayName "Block SharePoint Egress" `
  -Direction Outbound `
  -Program "C:\Windows\System32\inetsrv\w3wp.exe" `
  -Action Block `
  -RemoteAddress Internet