A new SharePoint vulnerability is already being exploited – Source: www.csoonline.com

Attackers are exploiting a recently disclosed remote code execution vulnerability in Microsoft SharePoint to gain initial access to corporate networks.

SharePoint’s main role in the Microsoft 365 ecosystem is for building intranets and dedicated web applications to support organizational processes. It is also used to build websites, and to gather together files in SharePoint teams connected to the Microsoft Teams communicator.

CVE-2024-38094 is a high-severity remote code execution (RCE) vulnerability that affects Microsoft SharePoint. Microsoft fixed the vulnerability on July 9, 2024 as part of July’s Patch Tuesday package, marking it as “important”.

Last week, CISA added CVE-2024-38094 to the catalog of known exploited vulnerabilities, but for security reasons did not specify how the vulnerability was exploited in attacks.

A report from Rapid7 last week sheds light on how attackers exploit the SharePoint vulnerability.

Rapid7 reports that the attackers used CVE-2024-38094 to gain unauthorized access to a vulnerable SharePoint server and run a webshell. Its investigation revealed that the server was exploited using a publicly disclosed SharePoint proof-of-concept exploit.

Using initial access, the attacker compromised a Microsoft Exchange service account with domain administrator privileges, gaining elevated access.

The attacker then installed Horoung Antivirus, which caused a conflict that disabled security and weakened detection, allowing him to install Impacket, a collection of open-source networking scripts.

Specifically, the attacker used a batch script (“hrsword install.bat”) to install Huorong Antivirus on the system, set up a custom service (“sysdiag”), run the driver (“sysdiag_win10.sys”), and run “HRSword.exe” using a VBS script.

This configuration caused numerous conflicts in resource allocation, loaded drivers, and active services, causing the company’s legitimate antivirus services to crash.

In the next stage, the attacker used the Mimikatz tool to collect credentials and Fast Reverse Proxy (FRP) for remote access through the firewall.

To avoid detection, Windows Defender was disabled, event logs were changed, and system logs on compromised systems were manipulated.

Additional tools such as everything.exe, Certify.exe, and Kerbrute were used to scan the network and generate ADFS certificates and affect the Active Directory environment.

To protect your organization against attacks based on SharePoint vulnerabilities, you should ensure that your Microsoft 365 environment is updated to the latest version, Computerworld Poland reports.