cbcvebase.
CVE-2021-27076
published 2021-03-11

CVE-2021-27076: Microsoft SharePoint Server Remote Code Execution Vulnerability

PriorityP181high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
14.39%
96.2th percentile
Microsoft SharePoint Server Remote Code Execution Vulnerability

Affected

12 ranges
VendorProductVersion rangeFixed in
microsoftbusiness_productivity_servers
microsoftmicrosoft_business_productivity_servers_2010_service_pack_2>= 13.0.0.0 < publicationpublication
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < publicationpublication
microsoftmicrosoft_sharepoint_foundation_2013_service_pack_1>= 15.0.0 < publicationpublication
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < publicationpublication
microsoftsharepoint_foundation
microsoftsharepoint_server
microsoftsharepoint_server
msrcmicrosoft_business_productivity_servers_2010_service_pack_2
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_foundation_2013_service_pack_1
msrcmicrosoft_sharepoint_server_2019

Detection & IOCsextracted from sources · hover to see the quote

domainconnect-microsoft[.]com
ip8.219.1[.]155
port8443
hashE83F331BD1EC115524EBFF7043795BBE
commandSchtasks /create /ru "SYSTEM" /tn "\Microsoft\Windows\Edge\Edgeupdates" /sc DAILY /tr "C:\ProgramData\SystemSettings.exe" /F
  • SettingSyncHost.exe running from a non-standard path (e.g., C:\Program Files\Chiniks\) instead of C:\Windows\System32\ or C:\Windows\SysWOW64\ indicates DLL sideloading abuse.
  • ·The attacker attributed to ToddyCat APT; exploitation requires the attacker to have privileges to create a site on the SharePoint server (not unauthenticated).

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.