CVE-2020-16952
published 2020-10-16CVE-2020-16952: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker…
PriorityP265high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
71.09%
99.4th percentile
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.
The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_foundation_2013_service_pack_1 | >= 15.0.0 < publication | publication |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < publication | publication |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_foundation | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_foundation_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://srcincite.io/pocs/cve-2020-16952.py.txt
urlhttps://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
snort↗
SID 55942
snort↗
SID 55943
snort↗
SID 55979
snort↗
SID 55980
snort↗
SID 55982
snort↗
SID 55983
snort↗
SID 55984
snort↗
SID 55989
snort↗
SID 55990
snort↗
SID 55993
snort↗
SID 55994
- →Detect vulnerable SharePoint versions via the MicrosoftSharePointTeamServices HTTP response header matching versions 15.0.0.(4571|5275|4351|5056) or 16.0.0.(10337|10364|10366)
- →The exploit chain uses a server-side include (SSI) to leak the web.config file and then forges a malicious ViewState using the extracted validation key — monitor for unusual SSI requests and ViewState deserialization activity on SharePoint HTTP endpoints ↗
- →Exploitation requires an authenticated user with page creation privileges uploading a specially crafted SharePoint application package — alert on application package uploads by low-privileged or guest accounts ↗
- →Exploitation results in code execution in the context of the SharePoint application pool and farm account — monitor for anomalous process spawning from SharePoint worker processes (w3wp.exe) ↗
- ·The Metasploit module was tested against a specific environment; confirm applicability before deploying ↗
- ·The VALIDATION_KEY option can be set to skip the SSI stage and go directly to ViewState deserialization if the key is already known ↗
- ·The Talos Snort rule set covers multiple October 2020 Patch Tuesday CVEs, not exclusively CVE-2020-16952; confirm which SIDs specifically target SharePoint SSI/ViewState exploitation ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_msrc8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft SharePoint Remote Code Execution Vulnerability
vendor_msrc·2020-10-13·CVSS 8.6
CVE-2020-16952 [HIGH] Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft SharePoint Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.
The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.
Microsoft Office SharePoint: Microsoft Office SharePoint
Issuing CNA: Microsoft
Impact: Remote Code Execution
Exploit Status:
GHSA
GHSA-4xg2-wcmm-2j45: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka
ghsa_unreviewed·2022-05-24·CVSS 8.6
CVE-2020-16952 [HIGH] CWE-346 GHSA-4xg2-wcmm-2j45: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16951.
GHSA
GHSA-vw6q-4xc8-h5wc: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka
ghsa_unreviewed·2022-05-24·CVSS 8.6
CVE-2020-16951 [HIGH] CWE-346 GHSA-vw6q-4xc8-h5wc: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16952.
No detection rules found.
Nuclei
Microsoft SharePoint - Remote Code Execution
nuclei·CVSS 7.8
CVE-2020-16952 [HIGH] Microsoft SharePoint - Remote Code Execution
Microsoft SharePoint - Remote Code Execution
Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
Template:
id: CVE-2020-16952
info:
name: Microsoft SharePoint - Remote Code Execution
author: dwisiswant0
severity: high
description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the SharePoint server.
remediation: |
Apply the latest security updates provided by Microsoft to address this vulnerability.
reference:
- https://srcincite.io/
Metasploit
Microsoft SharePoint Server-Side Include and ViewState RCE
metasploit
Microsoft SharePoint Server-Side Include and ViewState RCE
Microsoft SharePoint Server-Side Include and ViewState RCE
This module exploits a server-side include (SSI) in SharePoint to leak the web.config file and forge a malicious ViewState with the extracted validation key. This exploit is authenticated and requires a user with page creation privileges, which is a standard permission in SharePoint. The web.config file will be stored in loot once retrieved, and the VALIDATION_KEY option can be set to short-circuit the SSI and trigger the ViewState deserialization. Tested against SharePoint 2019 on Windows Server 2016.
Checkpoint
19th October – Threat Intelligence Bulletin
blogs_checkpoint·2020-10-19
CVE-2020-16898 19th October – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 19th October – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 19th October 2020, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Researchers and telecom companies have partnered to execute a coordinated attack aimed at disrupting the infamous Trickbot botnet and Malware-as-a-Service. A Court order granted the researchers control over the botnet’s infrastructure. However, the botnet was not fully disabled.
Dickey’s Barbeque Restaurant, an Am
Qualys
October 2020 Patch Tuesday – 87 Vulnerabilities, 11 Critical, SharePoint, TCP/IP Stack, Graphics, Adobe Vulns | Qualys
blogs_qualys·2020-10-13·CVSS 8.8
[HIGH] October 2020 Patch Tuesday – 87 Vulnerabilities, 11 Critical, SharePoint, TCP/IP Stack, Graphics, Adobe Vulns | Qualys
This month’s Microsoft Patch Tuesday addresses 87 vulnerabilities with 11 of them labeled as Critical. The 11 Critical vulnerabilities cover TCP/IP Stack, SharePoint, Windows Camera Codec Pack, Graphics and several other workstation vulnerabilities. Adobe issued patches today for Adobe Flash Player.
### Workstation Patches
Continuing the trend, today’s Patch Tuesday fixes many vulnerabilities that impact workstations. The Windows Camera Codec, GDI+, Browser, Hyper-V, Outlook, Media Foundation and Graphics components vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
### Windows TCP/IP RCE
An extremely critical R
Tenable
Microsoft’s October 2020 Patch Tuesday Addresses 87 CVEs including “Bad Neighbor” Windows TCP/IP Vulnerability (CVE-2020-16898)
blogs_tenable·2020-10-13·CVSS 8.8
[HIGH] Microsoft’s October 2020 Patch Tuesday Addresses 87 CVEs including “Bad Neighbor” Windows TCP/IP Vulnerability (CVE-2020-16898)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday for Oct. 2020 — Snort rules and prominent vulnerabilities
blogs_talos·2020-10-13·CVSS 8.8
[HIGH] Microsoft Patch Tuesday for Oct. 2020 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Alex McDonnell and Nick Biasini.
Microsoft released its monthly security update Tuesday, disclosing just under 100 vulnerabilities across its array of products.
Fourteen of the vulnerabilities are considered “critical" while the vast remainder are ranked as “important.” Users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation of all these bugs.
The security updates cover several different products including the SharePoint document management system, Azure Sphere and the Windows camera codec, which allows users to view a variety of video files on their machines.
Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For complete
Talos
Microsoft Patch Tuesday for Oct. 2020 — Snort rules and prominent vulnerabilities
blogs_talos·2020-10-13·CVSS 8.8
[HIGH] Microsoft Patch Tuesday for Oct. 2020 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for Oct. 2020 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Alex McDonnell and Nick Biasini.
Microsoft released its monthly security update Tuesday, disclosing just under 100 vulnerabilities across its array of products.
Fourteen of the vulnerabilities are considered “critical" while the vast remainder are ranked as “important.” Users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation of all these bugs.
The security updates cover several different products including the SharePoint document management system, Azure Sphere and the Windows camera codec, which allows users to view a variety of video files on their machines.
Talos also released a new set
Qualys
October 2020 Patch Tuesday – 87 Vulnerabilities, 11 Critical, SharePoint, TCP/IP Stack, Graphics, Adobe Vulns
blogs_qualys·2020-10-13·CVSS 8.8
[HIGH] October 2020 Patch Tuesday – 87 Vulnerabilities, 11 Critical, SharePoint, TCP/IP Stack, Graphics, Adobe Vulns
This month’s Microsoft Patch Tuesday addresses 87 vulnerabilities with 11 of them labeled as Critical. The 11 Critical vulnerabilities cover TCP/IP Stack, SharePoint, Windows Camera Codec Pack, Graphics and several other workstation vulnerabilities. Adobe issued patches today for Adobe Flash Player.
## Workstation Patches
Continuing the trend, today’s Patch Tuesday fixes many vulnerabilities that impact workstations. The Windows Camera Codec, GDI+, Browser, Hyper-V, Outlook, Media Foundation and Graphics components vulnerabilities should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
## Windows TCP/IP RCE
An extremely critical Rem
http://packetstormsecurity.com/files/159612/Microsoft-SharePoint-SSI-ViewState-Remote-Code-Execution.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952http://packetstormsecurity.com/files/159612/Microsoft-SharePoint-SSI-ViewState-Remote-Code-Execution.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
2020-10-16
Published