The first vulnerability in the chain is a deserialization issue that permits an authenticated attacker to trigger arbitrary code execution. The second flaw acts as an authentication bypass, allowing the attacker to reach the vulnerable deserialization endpoint without valid credentials. While Microsoft has released patches for both issues in recent updates, Defused reports that exploitation attempts are actively targeting organizations that have not yet applied the fixes.

• The attack chain requires initial access to a SharePoint site, but the authentication bypass removes the need for privileged credentials.
• Successful exploitation grants the attacker the ability to execute commands in the context of the SharePoint application pool.
• Defused observed the PoC being weaponized in the wild shortly after its disclosure, with scans targeting internet-facing SharePoint servers.

Defused advises administrators to prioritize patching all SharePoint servers immediately, as the exploit chain is now public and actively used. For organizations that cannot patch immediately, they recommend restricting network access to SharePoint services and monitoring for unusual process execution or web shell activity on affected hosts.

Source: BleepingComputer

Is your organization running any unpatched SharePoint instances, and how are you balancing the patch rollout with potential service downtime?