安全研究
CVE-2024-38094 Microsoft SharePoint RCE:未授权远程代码执行
Thinking
2024-07-09
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Microsoft SharePoint Server 的远程代码执行漏洞，CVSS 6.3，攻击者通过构造特殊请求绕过身份验证执行任意代码，影响大量企业 SharePoint 部署。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237686c78a236c0cc05eab1af1a1090c7cc62c0788c0035887aae447eadba0dc0c5e779724e699c9d56bf290bda1308a3180911ce10cf9fa2c04c224cbf8a807ee77787004e848a2b699e0b728a80e90c5d49d8883c035c54ab4b60ff203290b17d82b93d76dbc4e89c8f38b5a5d4fa42a3b8219bed7d69e11e0ac473d2b6309e1b0f40e30932086b682f5008c020f066835bd370e235097ad5544b828a8ad966cf9b70a6ace3e928c04a587a2bad799c6b5755d4d1127e01e7708c3e419465d90ccaa1a8e510aac3cf886415aa1492a64c728b532e2ac89180caadf3874e890a6163592cc3fb9a14fb778e22683e50602c6f639f77fd26b546a4e2b2b733f747c7730c3a0aed52a2073e8892a1609823407ab98d63524c57d98354b2ab6dd8eb47105df9f313c9a6bc5251faadb99064f5531447ece457a36b0875e73bf32a18b9a290220bcbee06a0677149adcecc6b1aa314325e2fca637dea6e9021f12377d71fe8da9ad539c7eb5407ec2ca1845882475c6183e36d7a8435fefcaf56b5c0b59e3c6c4d4a19bae4fd158db0a64199d50a5e27a2064ffeb88a0a2da172e6bc77413959ebd2f9811c5b21fc70099bad35cdbd390b19e852b7f7f047dc183bcdb10f2679ad9069fdc57d81de84c97dff153c6392870bae6ffac2aa8a9fa6e5572e934468b4d0c71fa0b0408759e8d02e84137277c0b0f78287c5b8cdb9b64c9d14935b07879dc788ee5bab58e437157b70bba3190efe8cd4dad9f83d65ee2f3d4fdd9c57382f6dbe04bb6e08d4950db5d30a919c6927dbd63375ffb99c5c6ea44e9e1db90ff0c1a754ad18a71744959e4fed09fbb7325bef99e1fb0a26e2fe2b1d367f20b233d693ef554ddf2ca9e8c0c2df055dac309bda32124c810c1d287b95342395a2ce412f89ace74dad19f0cfed10a751d6dcb0c033332f881d75e4a7e130186050c6250152812e2d2a8f6083542599e247ad08e9e0686977d7497c8c442dfbeff6a4ffd0055ec686366fa791cce74aac9f1b93905808e283d955000dfa4187e9ecfe15a686480135d2edcaca3fe7f3b33ea6dd6758cf3f5b170c2ac246851cd240a18d8b05900f38adf517c7ef615fbd3bcac7fa526cdc773b46b5776291696d70223c4903163304286e00a6cc1ca6a2957bb8096603355386b303d4b5da2e35b4535587bb1dcb58bd1aebee6cc01d5401badc91e665d4cb10fbc59f127a9a053835b2a75fdbc10423dc2e8b3470f5f80d5d777a6c9816f8053a8f6eadabad2b20a1d1451ca3cf46a24210c1992f5e21dd0c539c852af9634b37b842958451e6595bfd367ed5d59593b1a5279e0ffe912761eec63b85dca579f62a2a1405961012da3db3267b5d860a4c19df88af9c717f96918ed5d9987ec3c4cb7f907205a3b71359dc1d76b7e91135cfdae6448aebeb178e83cbf6d6fa6b549799d75793f8c270a2ce8062f98852e7d8f2071447917f0943c02d32edf416ba705a0c37b4ff463dd24ccf8a7698dbcec795448737b879d27b7bfd432456475165580129f8b5671d57f645eeeb8a129c8d0ac2291ad36a9eb05e6fe0705c57cb1099dda4f0a59dc35522180cd5c3c99f5c5a1b1954488517992ff7e9329e5cddb8a55c943e1da5064fbec32926cc61e13bf3f815f9a43b69bda6e0f8e9bd5b7f8af986ba2f07c8a388948aa3262ccb1b30f764f09bf273210123f8abce96d14f62d7dd3a50b55124ce7e59a9dd3d426d1deff345b6a1ece1431e99dd22aba773f92c72e9869a1fd0ec07c45b85dd2c6d5a7197b00a9248996d3c793d2b81824e5c3ec63bea3d0b2e40b0b2f93f3ead9f65b8262f4ee7b98755280f481961d8f0b2b01d56067b1bc2a103861a2f94d31d797d38ab8d70e4c946ddf853d0ea8848532e9191e62a511704acc50b67c8d056063df6225aac0dde145d38c071c14f4e090fec6d436d074db6114cdc20329890c76ab7392bed36d765f6eeb4b2d4401353dd2f194734344794e6317e9483f9b9fb89c475854e756603b4d64d46533fd8f1f69ed6d277f0191410e465b93f1e4bc260c55c5140e83a93b7d10485a1ea2740173d702d604f5efcc5fd0d0df4209e00b6616a8cf9cd9ac48eca2d362fb0999bb0d81d6cecd246134a75978ccdbefdb5c4cd9b78ceffce901c76dfe5e370b523be720ec6b165b913ff3612b20841179c6cf0871402730cf55f17a4ae167ef833e546b289ab8a8bf4ec54e1c2d43561816250f4586aa1810b32d14bc6686abbaaeda4bab3368af22c446bb097e6d810fb16831e6b7b1e2df2a1ab1d3485c0fea255ce7052aaba08ae7330d7d218d07454c189d344e3ad46bf304222b60d381cd4a19e4cf1b1b0b96fcc5df8d6a9493215dc37d0d2e855ce562f4e8ca1d8f0f108bc1cd4f2e458819d68485bf887bf84bc4ebea75a6b6f9812ab20683835ab4c7f914a3644e73af03774d66aab21779c4703a92745966cca3d1b7897e569718c70ee46480da8c1aa95c962311671eb803ede5ae24d6b94d32859cf56349b1e23dc7dfcd940b5916f3139c4877d83e400c32232ae0d0e4d374a5e6e7b9306ec04ed71b53a2d709c20d1ce0f6fb1004d6df95f6bce11895302e5927177eecd820e9028e26bc4f54b27bc4ad289bd2cedaa65b0390eb5632d6ac1b3f357bc0396578e35b1481e5f0635356352feb8727e9af8d02e350c515f94441709ced40c1f17439876273deb7666466d417765e810f63efc1fa915ec19808d63ef72e2ceda3ec3f2063763349e69270b2e39f6aa8ff309880b7b2790ae189f116c8ae71b0760ad52fd238c214ff36ac1bca703aec764361be51353a1ed4001d9bd36aa59b1b480c8f4c8a3e901ba822b9a4559da5531f882b243b92ecb305c8901198e80930da175dbd104dbba8d569283885fcfd0c8a1475a7850851c1d1b7fd999e4b43d2ae0443174dc91340a3329757a74c60a3c5a710ff92777cbf5ae9f9c4a39fc5b4af9be7287049a83219de4452840fee05d350e5310cb97949715ca99abbc0b7c4655a35972811d5bf2443a8149e0f36588a29ce4998a20f5db197722a48c4b11dc84ae5ca9f45d6b1f78cd3ba96c42d3f9ec4e86bdd62ea3dfd9b7671e3d32dd267eed8bd951252c4d907607a221fdcb6cc1d67e0de6d019bcbf8eb89463f435df9aac9d5c720501b8508789ab5fb2346f3f144ef148672033a04bea753b0c2fea8036fd8a74ef4e5b5da129a8a57324a8f7dda7f9c4c676dd2be10df93ff204fcea27f1763c71c2e071cc01eabeb7c635b66c7f815355aff14790d4b42770e2a2117f9119d49608cdc7f21172c293f5f37f5f5272d2c33ef77328aa4ea76e1042337c7392f5c59ef29c3d2d7e02c283c5f1adc79f46f662ec0092958ae26f8da15cc6601c5dec84f7ef40eb280dfc47fe2164bb5da25a376ab7da3c6325b19c3d9f0e72c7930acb61a0954f864925079a9693d4d71a15656ee128e4f798b870385726632258feb136801d2a191bd3c52d0854b848a5083705401375fdd658864442692a144e380815ae187878ec449b5f450edbd2d59c2b8dce58bfd19da8106d6ba39ac587411fba7db372df7ba766436f5677420f5b98f8d16423c65f27e4e097f67bbee58eb552803f0413d373df6ed78283d2285015074795dab3af0f8bec5acd3e120860c98dfd45f7698464e024b29e7117b33513502b4b1011b0bf168789bc26ed1042b74e7f429d85b9d10753102f5ee5e2167b5aa46e7a9f4a84731dfdc6407b6b3454256973cc85e5c0e3fa267a88331e09508a4ec4f153639763f30e410dc5024a9df880bd05e55770a794ae1b47ca420c1b076084fb729d0d1475e73df0ebde91564558c0c274dbc6416fcb3a3089b125f3bf509256cde338e4a47fec16c9abd70e1de910e73abfcedce3ba3466628074a298e593c4a7b7e2364fe0462a9f0b814f14096bcc5819902ea97865205d34d29b2235b2684f2434d5e35939dbf8ba8474a85196d251a03c407bda024ddad39935b1bf14770cbbf99e760256603dee6fb543d5de6a63f0e33ec4190f14ed8644d096bc14e563f374888c89b7246693cdce53c8ddcc51cafd2d500e96605e8e988c33b062f7bf613f6cea0c3941ab2015b947a6fe4f00b0be2c0235e5351ca4a78b6d07d5392cb01e84061d07860b448aa0e231291dc4d11dc26379d6daea390d7a285ba9cbeab6c5229993c287b1c07658822ec814dc7e4edd9e8ec447f6ca3ff1709aa0013ce6d818541109755f1f5707d4c7202571f6fbf0298b5407eab01913626e28002bd3000baffc9e352af63459922d27ecff6b84c8c71fd264a5e70d78969a3811aa226753b418da8451026df3d63212950db3969e8bbba6b1683d80c7f5cd05055670abc12314468d6efbf9f8b4ac4901dd35c135455be92f5e9c4e259b4d536a85bd0f7198a4a3ecf432666797d801d1e14622f6b2f67aa1802007c10a871bdd56e30266c297f1ce60ca95c4e8ddaa171664f48a7a1b3c5f708bd9e6057323db46af259fcfcc75289370646e1a1af0c0e33601d2c0918bc667dbc4582e6cff5b27d512f725bf8fde3d2bd2cef7654dc294e8018e381778fc13f8d049c0f3f263b8f01f0cfbce9a9d85389851fcefa891be63427d7bd5545e2e0a94b634fd5653fa7395e12a25824d8982a1f97294e349485ba8f848e59c7ca92b3cdf2f59c3f7dfddb04ba143208b5c0499c8507e09229ec570cb63432547f52002f762b6ba8e2943173ea2475af55436a383f9de8dd6390a871a61b4b24ceeb07af884cbc37c9465d3306a9c9a18bab0e4bf040daee59aa43679793dcd4355fcfdbda77ed830f781259021cb497e3e34e652c3736a4c766475e909c92d4b22df63206d9a5ef5c5f106e656a0fe515bbcb12c476c8c4ade241c44ea068a48c66c61cee2c2302268a69079631f68d2a1ce668f225f982e73d32fef9842bfd4f6003c3553bb9fc3e681af35af325a3eb4699302a4f6e92850da3f7f5d2d19b2e3f8ea3cfa0550f87580253fe13d83818ed57ca12db4a730de1a75bd9e86c3b8567ff135d021e589fbb5c2dd26669ed8f58e27f918b6c59c0ddeab6db5703c2e2bd7f070b6469436e3b143e41ea91d1151dd07f13f58f7ab0d093a94e142e942839e5652df8952d3ded42427794d62704cca0b63d4172f1dfb096a21a8ee4de3340935391772f7a63d398e931cdd07795879d0ec843973dd2abaf2eb33edf3098d7d0ab77caedaad6bf672565738d410309371314c29fe7f3b867d4e241935408cfb655413e80a027f2756909af7d45204a166224459b79af252afbe4d68ad64c5c290053b7661353e4971f4cac52c2b4fe17a95b2b08c5ecc9ec3561208d5814c5fb0110a0d8142709abab003753b486de7326173c17130ac7a5ce707d64ddf07e258e4bc4e03d805478072079a9cfabf07da8a3930d7d2d7bcd255e7fcf2557a8d61a7d2074a7c08522f2592462829495fe0adda81680e332c245286d50efb252ca154da00787b8bd1f36b897bd0316392f690e2db79967608236756118eca46bcc968a43dc3b95e2321c03e57d3a61f4c20b2bb3748e911b70296a0fc702c5cc48090210929074e6c46fa79245814f67430ac9e13259c5cd83002b98abf425303b2fd29609a874c022e007e627bdfc064b19eacafbccbf18fd08865474cd2dc0422c58a831844bf3bfd7eeccd041b61fd559d8708e3caef78b9b8ed108b15f71636d236e161bbe6b17e68ea250e2877caed3f7ea6fee190a5140292621734bd51ef695a872b1754866fb69fe32cf8050e80c330e8c1df90195e550b7d6b9999fe124fa700cd41d5908545d1c9fb3be49ab9d05ca3b8c7d87376c17f5fe1e0f1ae8570738cea85e6c38b89acd58671edadee17b68ff167e471cca4a698d02dbc9d3cd7132cb3869558462837e09a59297eb6be97db5a55343314298d9744a5f53bbb032434fa8ce37b387b3fbc737ea0737ea7bac16b25d7631be0cf8210a246286f14f907958e87cdfbde77543fd2150a38ac9ac93f651b043d6ebeb750ba915d5c380d9efd4bb76fbcf8d5edf3e9bf95b705eeab7e13c3930fe9b16f265bff8d5b6c1a44fe8c951996141acf845796b4773eb308c9e0cee50e30654428afe4e4c3ecdcdd67cc5b9cf9310fc6a5b8afa130080fc2992ca11360247da843da2849b10fce40a0c5bfb91edeada19275fc1200c0934dd5a73584c9b4cec8393ad0a9cc223194e0efc76cf5bddc64d10c98a96671c2d04c9289fcf64909e160681eaab7005568cf7616f15e1c921284940d31de56331e675915a53fa67152dd053c273bd4c20a1bd6aea0dbf0dc05140650c16e8ebbdd632485d6edadcac039322eeddb7413f071bda2ea62f90da2fddb4bec931de924ddc52f120b0d5d1a066fbc19a12de92401d918424c9e4287ec7b7e4b482fd04d6e6531f8f373ad2f9727f0c30da5bc2c9405f0dae0800d39b7ae26f05fb49f4d95c380670477ba8dbc4324d7c470913342d244e370b22e05a2d72eb09a5ecaf8c30b7e4f9e1a656b4f36502b8ad1a35a809eb6f86abc2875d212c489e159e8732fb04372aafdd2fcd9000db31e22f376fa4733bdcb1afd158142b05dc9fd3c762118ebb7cfb760db732fed1898971beca7a6571cc17c1ebb03fe8bc1c10847add757fca67e28cc44135aa4074dbc6b2a5bbe16b08fc12d6f2df30e3ec70c3cc4cb7f24a89637e0bc5663c14f90f3430dc0462a9a77a5b422fb232ec7a309115d0b5e94be5d16d73854575f2c0ad01b9deff504fb9fc7eda78e6c24750e10d35ba211fe7a7de17be04b56fa6dc94910002a3ab85f1e466205a4b0791dcd7d5e552accd35e1c41c1874cde1fdb76eef6e83cca97d531fb9460c3c8edc0ba7cb35ac3e88ea9333058c174c414f54a2dc9ebd023d6ced93f045963ca063cb93da57c291deb5e1d5334fa5c67a0ae6ac409b9119bf68bc0b2f1a58eed9e37cf391eac1bc7c5e29384b2268616c7cfaabf05457fc0cd1280cad4b0ab7eda626baadcdea87a1ba003d7abf2608e2cad0868179f13591ca9175c6278078bedc71c570a615e3fe071db332c27f9499c63541e5e17fdac28d811a999e509f58ef34ba242005b4c885c646890878044017736db7c1820e0439e511a9a107f5e92c2c12a210aad851cd7a0913358342e42bb3e906e5637377e66244d59e977b952ec7faf16ee81458e43e4ba689bf211d6818c23881bc81a5067cd647e3261a66f0875ea6415cc23fe2cc4c523224a15b050377cd0156bd42d42347492ce209bb671f22a6855048938eb6b2621c01a08c9e247710e2fca9e32cc21631e5424c09aea03b89c2634d394fcef52edf2fb3c8aee27599cb05598c040594da3585c1bfb7d17974ed449148bbc2b0eb8e626912582044937afd10c5b4b28d466d2c5b39026cabf2b1ad6703c33fe18843a0d62e9baab2498a76e4fa65df7734ab31a070d2d5d9c9688a84c56164d702d60b59166b8afec1706446a6b84d51c449ba9f83699d3d3a30b599b04f80d99b9901ccdb97404f29b251113cd15c55a42c9826f1a913594a15647c20cd8b7eee919bb825ed81d2ebb4906848a9d7b8dbc45347f934bf0ba135e1f2837380846487c526694d642f67fac0266cd6a5fac851dd8a4b74793425b09169b1f72d9051cc45a9f03fb7a5f88583097178b8165d8f1f9199b5b25d5ae4743f458a0a7ca5db2ee3b0802ba1fe2763b9e597d3abc4756006bee0b4cc224d2d5b11fc0d57edff4295bcdc2e9d6d06d92ac9938fe6bf03f373765983cf8f8ba7f523a83defc7a2884d6a733268f4cfb63fcbd8fa0a3d2ecec99688ef53121ed551f7cbfccd9cec432e3deab32914b9cf69930cd82f1644cc888559b624993f9f6947ab3be9e42c6748a746f49186e44a8b186ea7f998134939820204a255c1c125c27ec1420db89a97c328d44f8d1dd749fb417a55557a427a98b1913f3f5b802f240273988b9edc6335089a6ad17f68cf6f4d5c6b247f3f4834c873fefcec5e0a0312c9ea9de802903a2c66171846cb3aa391ba3395c544fa79728df91bcdfe5840169713fd73164b34a55ed9987b661ad4056b17f35ffcc17b3b3d823ec7764deb3df01a20dc3d96d6a5c7b3b98c6d5208d680de3c45b9b31e13d06c2d9be98fafc465f371e1ff553f564dd93c9277532b0bbd572d5ff01670964f0480ae54144fd21d00ec95d223a66cf3b33042e46dab5ac9e82cfc09d8a3897e766bd351999b8dcdd67bd34f30e6ce77b3334b6076e302762a1f770bca699bbb30a642f9a768e175e86da25145dc8108871d94e278dd99ed5451859576277a35e43fe896ef174a80d70327fc178a1a0b3c1b0dd43f7b8a15bd4ba6093dcf3ba089a2c005b3f05793e50466a73c0673bc323bf76f076c43b4f16c2b56130ad17bc26ba477091f7f7948a9040960884b58f26a0eed2539f7507ddd0bcd7dc9630b62ee07d6ef7a8c594900