CVE-2020-1102 — Microsoft SharePoint Remote Code Execution Vulnerability
Executive Summary
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.
Overview
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Microsoft SharePoint Enterprise Server 2016 | 4484336 (Security Update) |
Critical | Remote Code Execution | Maybe |
| Microsoft SharePoint Server 2019 | 4484332 (Security Update) |
Critical | Remote Code Execution | Maybe |
Patches
| Article | Type | Restart |
|---|---|---|
4484336 |
Security Update | Maybe |
4484332 |
Security Update | Maybe |
Exploits & PoC
1 public PoCUnverified third-party code
Public proof-of-concept repositories aggregated from PoC-in-GitHub. They are not reviewed and may be incomplete, non-functional, or malicious — inspect the code before running anything.
| Repository | Stars | Published | Description |
|---|---|---|---|
| DanielRuf/snyk-js-jquery-565129 | 27 | 2020-04-14 | patches for SNYK-JS-JQUERY-565129, SNYK-JS-JQUERY-567880, CVE-2020-1102, CVE-2020-11023, includes the patches for SNYK-JS-JQUERY-174006, CVE-2019-11358, CVE-2019-5428 |
Detection Rules
Acknowledgments
Secventuregroup working with Trend Micro's Zero Day Initiative