CVE-2024-38018: Microsoft SharePoint Server Remote Code Execution Vulnerability

PriorityP273high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

51.46%

98.8th percentile

Microsoft SharePoint Server Remote Code Execution Vulnerability

Affected

8 ranges

Vendor	Product	Version range	Fixed in
microsoft	microsoft_sharepoint_enterprise_server_2016	>= 16.0.0 < 16.0.5465.1001	16.0.5465.1001
microsoft	microsoft_sharepoint_server_2019	>= 16.0.0 < 16.0.10414.20002	16.0.10414.20002
microsoft	microsoft_sharepoint_server_subscription_edition	>= 16.0.0 < 16.0.17928.20086	16.0.17928.20086
microsoft	sharepoint_server	—	—
microsoft	sharepoint_server	—	—
msrc	microsoft_sharepoint_enterprise_server_2016	—	—
msrc	microsoft_sharepoint_server_2019	—	—
msrc	microsoft_sharepoint_server_subscription_edition	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/_vti_bin/webpartpages.asmx

bytes

|3c|AttachedPropertiesShared|3e 2f|wE

snort

alert http any any -> $HOME_NET any (msg:"ET HUNTING Microsoft Sharepoint Deserialization RCE via SPThemes (CVE-2024-38018)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/_vti_bin/webpartpages.asmx"; endswith; http.request_body; content:"|3c|AttachedPropertiesShared|3e 2f|wE"; fast_pattern; reference:url,blog.viettelcybersecurity.com/sharepoint_properties_deser/; classtype:attempted-user; sid:2064129; rev:1; metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2025_08_22, cve CVE_2024_38018, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_08_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Monitor for HTTP POST requests targeting the SharePoint Web Part Pages SOAP endpoint, which is the attack vector for this deserialization RCE.
→Detect the deserialization payload pattern in the HTTP request body — the byte sequence |3c|AttachedPropertiesShared|3e 2f|wE is the fast-pattern anchor for the SPThemes deserialization exploit.
→The rule is tagged for TLS-decrypted traffic (tls_state TLSDecrypt), meaning detection requires TLS inspection at the perimeter or internally.
→The exploit requires a minimum of Site Member permissions (PR:L); alert on authenticated low-privileged users making SOAP calls to webpartpages.asmx. ↗

·The Snort/Suricata rule (sid:2064129) requires TLS decryption to be effective, as SharePoint traffic is typically HTTPS. Without TLS inspection, the request body content match will not fire.
·Exploitation is rated 'Exploitation More Likely' by Microsoft despite not yet being publicly exploited at time of advisory publication. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vendor_msrc8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.