Microsoft SharePoint vulnerability being exploited

Microsoft SharePoint vulnerability CVE-2019-0604 is being actively exploited by attackers.

Microsoft released patches for this vulnerability in security updates earlier this year, however any system that remains unpatched is vulnerable to this attack.

The following SharePoint servers are vulnerable if unpatched:

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Foundation 2010 Service Pack 2
• Microsoft SharePoint Foundation Service Pack 1
• Microsoft SharePoint Server 2010 Service Pack 2
• Microsoft SharePoint Server 2013 Service Pack 1
• Microsoft SharePoint Server 2019

Microsoft’s advisory on CVE-2019-0604 SharePoint remote code execution vulnerability External Link

Organisations tracking these incidents have noted that attackers compromise vulnerable SharePoint servers, and install a version of the ChinaChopper webshell. This allows attackers to carry out remote code execution attacks.

The Canadian Centre for Cyber Security has published some indicators of compromise regarding this attack.

Canadian Centre for Cyber Security’s ChinaChopper malware advisory External Link

CERT NZ recommends you patch any Microsoft SharePoint servers that are not up-to-date.

If you are unable to apply these security updates, we recommend you use other security controls to mitigate this risk – primarily ensuring your SharePoint Service is not accessible from the internet.