CVE-2019-0604
Microsoft SharePoint Remote Code Execution Vulnerability
Description
CVE-2019-0604 is a critical-severity remote code execution vulnerability in Microsoft SharePoint. The vulnerability occurs when SharePoint fails to properly check the source markup of an application package, enabling an attacker to execute arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. This improper input validation flaw affects SharePoint Server 2010, SharePoint Foundation 2013, SharePoint Enterprise Server 2016, and SharePoint Server 2019. CISA has confirmed active exploitation and added CVE-2019-0604 to its Known Exploited Vulnerabilities catalog. This vulnerability is known to be used in ransomware campaigns, and the EPSS score of 94.4% (99.9th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint enterprise server | 2016 |
| microsoft | sharepoint foundation | 2013 |
| microsoft | sharepoint server | 2010; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/106914(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper input validation occurs when software does not properly validate input before processing it. In CVE-2019-0604, Microsoft SharePoint fails to adequately validate the source markup of application packages, allowing an attacker to submit specially crafted requests that bypass security checks and achieve remote code execution on the SharePoint server.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2019-0604 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing maximum-severity risk. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivial to exploit once a vulnerable SharePoint instance is identified. Confidentiality (High): an attacker gains access to all data stored in SharePoint, including sensitive documents, credentials, and business information. Integrity (High): code execution in the application pool context allows modification of SharePoint content, configurations, and potentially the underlying server. Availability (High): exploitation can lead to complete service disruption of the SharePoint environment. The EPSS score of 94.4% (99.9th percentile) confirms near-certain exploitation, and the confirmed use in ransomware campaigns makes this an immediate critical priority for organizations running SharePoint.
Exploit Maturity
CVE-2019-0604 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. This vulnerability is known to be used in ransomware campaigns, significantly elevating the threat level. The EPSS score of 94.4% (99.9th percentile) indicates near-certain exploitation activity. While no specific public exploit URLs were tagged in the available references, the extremely high EPSS score and ransomware association confirm that reliable exploitation techniques are widely available in the threat landscape. The combination of network accessibility, low complexity, and no authentication makes this vulnerability highly attractive to both targeted attackers and automated exploitation frameworks.
Remediation
- Apply Microsoft security updates immediately as required by CISA KEV: Apply updates per vendor instructions. Patches are available through the Microsoft Security Response Center.
- Verify that all affected SharePoint installations have been patched: SharePoint Server 2010, SharePoint Foundation 2013, SharePoint Enterprise Server 2016, and SharePoint Server 2019. Apply the latest cumulative updates for each version.
- If immediate patching is not possible, restrict network access to the SharePoint server by placing it behind a web application firewall (WAF) with rules to detect and block malicious application package submissions and serialization attacks.
- Monitor SharePoint application pool processes (w3wp.exe) for anomalous child process creation, unexpected network connections, and suspicious file system activity. Review SharePoint ULS logs for unusual application package processing errors.
- Conduct a thorough security review of the SharePoint environment, including verifying the integrity of installed solutions and add-ins, reviewing farm account permissions, and ensuring that SharePoint servers are segmented from critical internal network resources. Given the ransomware association, verify that offline backups of SharePoint content databases are current and recoverable.
Technical Details
CVE-2019-0604 is an improper input validation vulnerability in Microsoft SharePoint's handling of application package source markup. The flaw allows an attacker to send specially crafted requests to a vulnerable SharePoint server that bypass the input validation controls on application packages. When the server processes the malicious markup, it results in arbitrary code execution within the context of the SharePoint application pool identity and the server farm account. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum exploitability conditions: network-based attack with low complexity, no privileges required, no user interaction needed, yielding complete compromise of confidentiality, integrity, and availability. The exploitability score of 3.9 is the highest possible, confirming the trivial nature of exploitation.
Frequently Asked Questions
Is CVE-2019-0604 being actively exploited?
Yes. CVE-2019-0604 is listed in the CISA Known Exploited Vulnerabilities catalog with confirmed active exploitation. This vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.4% (99.9th percentile) indicates near-certain exploitation activity across the threat landscape.
What products are affected by CVE-2019-0604?
CVE-2019-0604 affects Microsoft SharePoint Server 2010, SharePoint Foundation 2013, SharePoint Enterprise Server 2016, and SharePoint Server 2019. All versions of these products prior to the security patch are vulnerable.
How do I fix CVE-2019-0604?
Apply the security updates provided by Microsoft through the MSRC advisory for all affected SharePoint installations. If patching is not immediately possible, deploy a web application firewall to restrict access and monitor for exploitation attempts. Given the ransomware risk, ensure offline backups are current.
How severe is CVE-2019-0604?
CVE-2019-0604 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. With an EPSS score of 94.4% in the 99.9th percentile, confirmed ransomware usage, and no authentication required for exploitation, this is one of the most dangerous vulnerabilities affecting SharePoint environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.