certfr_alerte - certfr-2019-ale-008

CERTFR-2019-ALE-008

Vulnerability from certfr_alerte

Depuis début mai 2019, des campagnes d'attaques ciblées exploitant la vulnérabilité CVE-2019-0604 sont rapportées publiquement.

Cette vulnérabilité permet à un attaquant d'exécuter du code arbitraire à distance en exploitant une faille de dé-sérialisation dans les serveurs SharePoint par l'envoi d'une requête malveillante spécialement conçue. Cloudflare indique dans son analyse que la vulnérabilité est exploitable sans authentification [5], ce qui n'a pas été confirmé pas Microsoft.

Microsoft a publié un premier correctif à l'occasion de sa mise à jour mensuelle de février 2019 [1][2]. De nouveaux correctifs ont été publiés en mars et avril 2019 pour couvrir d'autres versions vulnérables de SharePoint et certains cas d'exploitations qui n'avaient pas été pris en charge.

Cette vulnérabilité a été découverte par le chercheur Markus Wulftange qui a publié ses travaux en mars 2019 [3].

Du code d'attaque exploitant cette vulnérabilité est disponible sur internet. Il n'est toutefois pas utilisable sans modification, ce qui explique que cette vulnérabilité n'est pas encore massivement exploitée.

Cependant, devant l'augmentation des cas d'exploitation, plusieurs entreprises de sécurité informatique, ainsi que certains CERT nationaux, ont communiqué sur le sujet (cf. section Documentation). Des règles de détection réseau et système [4] et des indicateurs de compromissions [5][6][7] ont été publiés. Ces derniers doivent être recherchés sur les serveurs SharePoint si les journaux de connexion indiquent des tentatives d'accès aux URLs vulnérables.

Si ce n'est pas encore fait, le CERT-FR recommande l'application des correctifs dans les plus brefs délais.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft SharePoint Enterprise Server 2016
Microsoft	N/A	Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft	N/A	Microsoft SharePoint Server 2013 Service Pack 1
Microsoft	N/A	Microsoft SharePoint Server 2010 Service Pack 2
Microsoft	N/A	Microsoft SharePoint Foundation 2010 Service Pack 2
Microsoft	N/A	Microsoft SharePoint Server 2019

References

Title

Publication Time

Tags

[1] Bulletin de sécurité Microsoft CVE-2019-0604 du 12 février 2019	None	vendor-advisory
[2] Avis CERT-FR CERTFR-2019-AVI-061	-	other
[4] Billet de blogue AlienVault du 10 mai 2019	-	other
[3] Billet de blogue ZDI du 13 mars 2019	-	other
[6] Alerte Canadian Centre for Cyber Security du 23 avril 2019	-	other
[7] Alerte NCSC saoudien	-	other
[5] Billet Cloudflare du 28 mai 2019	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft SharePoint Enterprise Server 2016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Foundation 2013 Service Pack 1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Server 2013 Service Pack 1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Server 2010 Service Pack 2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Foundation 2010 Service Pack 2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Server 2019",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2019-07-23",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-0604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0604"
    }
  ],
  "initial_release_date": "2019-05-29T00:00:00",
  "last_revision_date": "2019-07-23T00:00:00",
  "links": [
    {
      "title": "[2] Avis CERT-FR CERTFR-2019-AVI-061",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2019-AVI-061/"
    },
    {
      "title": "[4] Billet de blogue AlienVault du 10 mai 2019",
      "url": "https://www.alienvault.com/blogs/labs-research/sharepoint-vulnerability-exploited-in-the-wild/"
    },
    {
      "title": "[3] Billet de blogue ZDI du 13 mars 2019",
      "url": "https://www.zerodayinitiative.com/blog/2019/3/13/cve-2019-0604-details-of-a-microsoft-sharepoint-rce-vulnerability"
    },
    {
      "title": "[6] Alerte Canadian Centre for Cyber Security du 23 avril 2019",
      "url": "https://cyber.gc.ca/en/alerts/china-chopper-malware-affecting-sharepoint-servers"
    },
    {
      "title": "[7] Alerte NCSC saoudien",
      "url": "https://www.ncsc.gov.sa/wps/portal/ncsc/home/Alerts/"
    },
    {
      "title": "[5] Billet Cloudflare du 28 mai 2019",
      "url": "https://blog.cloudflare.com/stopping-cve-2019-0604/"
    }
  ],
  "reference": "CERTFR-2019-ALE-008",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-05-29T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte.",
      "revision_date": "2019-07-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Depuis d\u00e9but mai 2019, des campagnes d\u0027attaques cibl\u00e9es exploitant la\nvuln\u00e9rabilit\u00e9 CVE-2019-0604 sont rapport\u00e9es publiquement.\n\nCette vuln\u00e9rabilit\u00e9 permet \u00e0 un attaquant d\u0027ex\u00e9cuter du code arbitraire\n\u00e0 distance en exploitant une faille de d\u00e9-s\u00e9rialisation dans les\nserveurs SharePoint par l\u0027envoi d\u0027une requ\u00eate malveillante sp\u00e9cialement\ncon\u00e7ue. Cloudflare indique dans son analyse que la vuln\u00e9rabilit\u00e9 est\nexploitable sans authentification \\[5\\], ce qui n\u0027a pas \u00e9t\u00e9 confirm\u00e9 pas\nMicrosoft.\n\nMicrosoft a publi\u00e9 un premier correctif \u00e0 l\u0027occasion de sa mise \u00e0 jour\nmensuelle de f\u00e9vrier 2019 \\[1\\]\\[2\\]. De nouveaux correctifs ont \u00e9t\u00e9\npubli\u00e9s en mars et avril 2019 pour couvrir d\u0027autres versions vuln\u00e9rables\nde SharePoint et certains cas d\u0027exploitations qui n\u0027avaient pas \u00e9t\u00e9 pris\nen charge.\n\nCette vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte par le chercheur\u00a0Markus Wulftange\nqui a publi\u00e9 ses travaux en mars 2019 \\[3\\].\n\nDu code d\u0027attaque exploitant cette vuln\u00e9rabilit\u00e9 est disponible sur\ninternet. Il n\u0027est toutefois pas utilisable sans modification, ce qui\nexplique que cette vuln\u00e9rabilit\u00e9 n\u0027est pas encore massivement exploit\u00e9e.\n\nCependant, devant l\u0027augmentation des cas d\u0027exploitation, plusieurs\nentreprises de s\u00e9curit\u00e9 informatique, ainsi que certains CERT nationaux,\nont communiqu\u00e9 sur le sujet (cf. section Documentation). Des r\u00e8gles de\nd\u00e9tection r\u00e9seau et syst\u00e8me \\[4\\] et des indicateurs de compromissions\n\\[5\\]\\[6\\]\\[7\\] ont \u00e9t\u00e9 publi\u00e9s. Ces derniers doivent \u00eatre recherch\u00e9s\nsur les serveurs SharePoint si les journaux de connexion indiquent des\ntentatives d\u0027acc\u00e8s aux URLs vuln\u00e9rables.\n\nSi ce n\u0027est pas encore fait, le CERT-FR recommande l\u0027application des\ncorrectifs dans les plus brefs d\u00e9lais.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft SharePoint Server",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "[1] Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2019-0604 du 12 f\u00e9vrier 2019",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604"
    }
  ]
}

CVE-2019-0604 (GCVE-0-2019-0604)

Vulnerability from cvelistv5

Published

2019-03-06 00:00

Modified

2025-10-21 23:45

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Remote Code Execution

Summary

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.

References

URL

Tags

	http://www.securityfocus.com/bid/106914	vdb-entry, x_refsource_BID
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

Microsoft

Microsoft SharePoint Server

Version: 2010 Service Pack 2
Version: 2019

	Microsoft	Microsoft SharePoint Foundation	Version: 2013 Service Pack 1
	Microsoft	Microsoft SharePoint Enterprise Server	Version: 2016

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:51:27.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106914",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106914"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2019-0604",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T16:20:47.392214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:45:42.715Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2019-0604 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft SharePoint Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2010 Service Pack 2"
            },
            {
              "status": "affected",
              "version": "2019"
            }
          ]
        },
        {
          "product": "Microsoft SharePoint Foundation",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2013 Service Pack 1"
            }
          ]
        },
        {
          "product": "Microsoft SharePoint Enterprise Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2016"
            }
          ]
        }
      ],
      "datePublic": "2019-03-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka \u0027Microsoft SharePoint Remote Code Execution Vulnerability\u0027. This CVE ID is unique from CVE-2019-0594."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-06T10:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "106914",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106914"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0604",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Microsoft SharePoint Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2010 Service Pack 2"
                          },
                          {
                            "version_value": "2019"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Microsoft SharePoint Foundation",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2013 Service Pack 1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Microsoft SharePoint Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2016"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka \u0027Microsoft SharePoint Remote Code Execution Vulnerability\u0027. This CVE ID is unique from CVE-2019-0594."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106914",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106914"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-0604",
    "datePublished": "2019-03-06T00:00:00.000Z",
    "dateReserved": "2018-11-26T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:45:42.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2019-ALE-008

Vulnerability from certfr_alerte

Solution

CVE-2019-0604 (GCVE-0-2019-0604)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature