CVE-2025-64672: Microsoft SharePoint Server XSS Vulnerability

CVE-2025-64672 Overview

CVE-2025-64672 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of input during web page generation [CWE-79]. An authorized attacker can exploit the vulnerability to perform spoofing over a network. Successful exploitation can lead to high impact on confidentiality, integrity, and availability, with a scope change indicating effects beyond the vulnerable component. The vulnerability requires user interaction to trigger and low privileges to initiate the attack.

Critical Impact

Authorized attackers can inject malicious script into SharePoint-generated web pages, enabling spoofing attacks that compromise confidentiality, integrity, and availability across the affected scope.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Deployments using microsoft:sharepoint_server (subscription channel)
• SharePoint sites rendering user-supplied content without proper output encoding

Discovery Timeline

• 2025-12-09 - CVE-2025-64672 published to NVD
• 2025-12-12 - Last updated in NVD database

Technical Details for CVE-2025-64672

Vulnerability Analysis

The vulnerability resides in SharePoint Server's handling of user-supplied input rendered into dynamically generated web pages. SharePoint fails to neutralize special characters before reflecting input into HTML output. An authenticated attacker with low privileges can inject script payloads that execute in the browser of a targeted user. Because the CVSS scope is changed, executed script can impact resources beyond the vulnerable SharePoint component, including authenticated sessions, federated identities, and downstream applications.

The attack requires user interaction, typically a victim clicking a crafted link or viewing a poisoned SharePoint page or list item. Once triggered, injected script runs in the SharePoint origin context. Attackers can spoof trusted interface elements, harvest session tokens, exfiltrate documents, or pivot to additional internal services accessible to the victim.

Root Cause

The root cause is improper output encoding in SharePoint web page generation routines. User-controlled data flows from input fields, list metadata, or web part properties into the rendered HTML response without contextual sanitization. The defect maps to CWE-79, Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires an authenticated SharePoint account. The attacker stores or reflects malicious payloads within SharePoint content, then lures a privileged user to interact with the crafted resource. Script execution occurs in the victim's browser under the SharePoint origin, enabling spoofing and session abuse. No verified public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See the Microsoft Security Response Center advisory for CVE-2025-64672 for vendor technical details.

Detection Methods for CVE-2025-64672

Indicators of Compromise

• SharePoint list items, web part properties, or document metadata containing <script>, javascript:, or encoded JavaScript payloads
• Unexpected outbound requests from user browsers to attacker-controlled domains following SharePoint page loads
• Anomalous SharePoint authentication events shortly after a user opens a shared link or list item
• IIS logs showing requests with reflected payload parameters returning 200 status codes on SharePoint endpoints

Detection Strategies

• Inspect SharePoint content stores and ULS logs for HTML and script characters within fields that should contain plain text
• Monitor browser-side telemetry for script execution originating from SharePoint pages referencing external domains
• Correlate user interaction events with subsequent token requests or privilege changes in Entra ID and SharePoint audit logs
• Apply web application firewall (WAF) rules that flag XSS payload patterns in requests to /sites/, /_layouts/, and list view endpoints

Monitoring Recommendations

• Enable SharePoint audit logging for content modifications, list item edits, and page customizations
• Forward IIS, ULS, and Entra ID sign-in logs to a centralized analytics platform for cross-source correlation
• Alert on rare user-agent strings or anomalous referer chains targeting SharePoint document libraries
• Track creation of new web parts or page customizations by accounts that do not typically perform such actions

How to Mitigate CVE-2025-64672

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-64672 to all SharePoint Server Subscription Edition instances
• Audit existing SharePoint content for stored XSS payloads in list items, pages, and web part properties
• Review and tighten contribute and design permissions to limit which accounts can author HTML or scripts
• Rotate session tokens and review recent authentication activity for users with elevated SharePoint privileges

Patch Information

Microsoft has published an update for CVE-2025-64672 through the Microsoft Security Response Center. Administrators should consult the Microsoft Vulnerability Update for CVE-2025-64672 for the applicable build numbers and deployment guidance for SharePoint Server Subscription Edition.

Workarounds

• Restrict the AddAndCustomizePages permission and disable custom script on SharePoint sites where it is not required
• Deploy a WAF policy that blocks common XSS payload signatures targeting SharePoint URLs and form fields
• Enforce least-privilege access so that only trusted authors can publish HTML, web parts, or page layouts
• Require multi-factor authentication for all SharePoint users to reduce the impact of session token theft

# Disable custom script on SharePoint Online/Server sites via PowerShell
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/example -DenyAddAndCustomizePages 1

# Verify the setting
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/example | Select Url, DenyAddAndCustomizePages