CVE-2024-38094
Microsoft SharePoint Deserialization Vulnerability
Description
CVE-2024-38094 is a high-severity remote code execution vulnerability in Microsoft SharePoint Server that allows an authenticated attacker with Site Owner privileges to inject and execute arbitrary code on the SharePoint server. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. With a CVSS v3.1 base score of 7.2 (HIGH), the vulnerability requires high privileges (PR:H) but no user interaction, and has been confirmed as actively exploited in the wild. CISA added CVE-2024-38094 to the Known Exploited Vulnerabilities catalog with a known ransomware association, and its EPSS score of 64.78% at the 98.4th percentile indicates significant exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | -; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38094(US Government Resource)
Weakness Type
Unspecified Weakness
Microsoft has not disclosed the specific CWE classification for CVE-2024-38094. Based on the vulnerability description, it involves a deserialization or input validation flaw in SharePoint Server that allows authenticated users with Site Owner permissions to execute arbitrary code on the underlying server. The remote code execution mechanism enables privileged SharePoint users to escape the application sandbox and gain operating system-level access to the server.
Learn more: Microsoft Security Advisory for CVE-2024-38094
Impact Analysis
The impact of CVE-2024-38094 spans all three security pillars, with Confidentiality (High), Integrity (High), and Availability (High) fully compromised. The attack is network-accessible (AV:N) with low complexity (AC:L), but requires high privileges (PR:H) corresponding to SharePoint Site Owner permissions. While the elevated privilege requirement limits the initial attack surface, Site Owner access is commonly granted to many users in enterprise SharePoint environments, and can also be obtained through credential theft or privilege escalation. Successful exploitation gives the attacker operating system-level code execution on the SharePoint server, enabling access to all hosted documents, databases, and connected services. The confirmed ransomware nexus (Ransomware=Known) makes this vulnerability particularly dangerous, as attackers have been observed using SharePoint RCE as an initial access vector to deploy ransomware across enterprise networks. The EPSS score of 64.78% at the 98.4th percentile indicates active, ongoing exploitation campaigns targeting unpatched SharePoint installations.
Exploit Maturity
CVE-2024-38094 has high exploit maturity with confirmed active exploitation and a known ransomware nexus. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 12, 2024, explicitly noting that ransomware groups are leveraging this vulnerability. The EPSS score of 64.78% at the 98.4th percentile reflects significant exploitation activity. Microsoft published the security update in the July 2024 Patch Tuesday advisory. Public proof-of-concept exploit code has been made available, and threat actors have been observed weaponizing this vulnerability to gain initial access to enterprise networks. The combination of SharePoint's widespread deployment in corporate environments and the relatively common Site Owner privilege makes this an attractive target for ransomware operators seeking high-value network footholds.
Remediation
-
Apply the Microsoft security update immediately by installing the July 2024 cumulative update for SharePoint Server from the Microsoft Security Response Center advisory. This patch addresses the remote code execution vulnerability across all affected SharePoint Server versions.
-
Review and restrict Site Owner permissions across all SharePoint site collections. Audit which users have Site Owner or higher privileges and reduce the number of privileged accounts to the minimum necessary. Implement just-in-time access for administrative tasks where possible.
-
Monitor SharePoint servers for indicators of compromise by reviewing Windows event logs, IIS logs, and SharePoint ULS logs for suspicious activities including unusual process creation, unexpected file modifications in SharePoint directories, and anomalous network connections from the SharePoint server.
-
Implement network segmentation to limit the blast radius if a SharePoint server is compromised. Restrict outbound network access from SharePoint servers to prevent command-and-control communications and lateral movement, and isolate SharePoint from critical internal resources.
-
Deploy endpoint detection and response (EDR) on SharePoint servers to detect and block post-exploitation activities such as web shell deployment, credential dumping, and ransomware staging that have been observed in attacks leveraging this vulnerability.
Technical Details
CVE-2024-38094 is a remote code execution vulnerability in Microsoft SharePoint Server. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates a network-accessible (AV:N), low-complexity (AC:L) attack that requires high privileges (PR:H) but no user interaction (UI:N), with Unchanged scope (S:U) and maximum impact on confidentiality, integrity, and availability. The high privilege requirement (PR:H) maps to SharePoint Site Owner permissions, which grant extensive control over a site collection's content and configuration. The vulnerability allows an authenticated attacker with these privileges to inject specially crafted requests that escape the SharePoint application layer and execute arbitrary code on the underlying Windows server operating system with the SharePoint service account's privileges. The attack mechanism leverages SharePoint's content processing pipeline, where malicious payloads crafted by an authenticated Site Owner can trigger code execution outside the intended application sandbox. The Unchanged scope (S:U) indicates the vulnerability's direct impact is limited to the SharePoint server itself, though in practice the server's network position and access to backend databases, file shares, and Active Directory provide extensive lateral movement opportunities.
Frequently Asked Questions
Is CVE-2024-38094 being actively exploited?
Yes, CISA has confirmed active exploitation and added CVE-2024-38094 to the Known Exploited Vulnerabilities catalog. The vulnerability has a known ransomware association, with threat actors using it as an initial access vector to deploy ransomware in enterprise environments.
What products are affected by CVE-2024-38094?
Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 are affected. Organizations running any of these versions without the July 2024 security update are vulnerable.
How do I fix CVE-2024-38094?
Install the July 2024 cumulative update for SharePoint Server from Microsoft. Additionally, audit and restrict Site Owner permissions, monitor servers for indicators of compromise, and implement network segmentation to limit lateral movement.
How severe is CVE-2024-38094?
CVE-2024-38094 is rated HIGH with a CVSS v3.1 score of 7.2. While it requires Site Owner privileges to exploit, this permission level is commonly held by many users in enterprise SharePoint deployments. The confirmed ransomware nexus elevates the practical risk significantly beyond its CVSS score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.