Vulnerabilidad de Elevación de Privilegios en Microsoft SharePoint

The SSRF vulnerability in SharePoint Enterprise Server allows an attacker who has authenticated access to the system to craft malicious requests that appear to originate from the SharePoint server itself. This can be exploited to access internal resources that are otherwise protected, such as databases, APIs, or other internal services. Successful exploitation could lead to data exfiltration, privilege escalation, and potentially complete compromise of the affected SharePoint environment. The attacker could potentially use SharePoint as a springboard to launch attacks against other systems on the network, expanding the blast radius beyond just the SharePoint server itself. While the vulnerability requires authentication, the potential for privilege escalation makes it a significant security risk.

Organizations heavily reliant on Microsoft SharePoint Enterprise Server for document management, collaboration, and internal applications are at significant risk. Environments with weak authentication controls or inadequate network segmentation are particularly vulnerable. Shared hosting environments where multiple tenants share the same SharePoint instance should also be carefully assessed.

• sharepoint: Examine SharePoint logs for unusual outbound requests, particularly those targeting internal IP addresses or services. Use PowerShell to check for suspicious scheduled tasks or web parts.

Get-SPOSite -Limit 1000 | Select-Object URL, Title

• generic web: Monitor access logs for requests to internal resources that should not be accessible from the outside. Check response headers for signs of SSRF exploitation.

curl -I <sharepoint_url> | grep -i 'X-SharePoint-Environment'

1. 2025-08-12Disclosure

   disclosure

1. Reservado2025-07-09
2. Publicada2025-08-12
3. Modificada2026-02-13
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-53760 is to upgrade Microsoft SharePoint Enterprise Server to version 16.0.18526.20518 or later. If immediate upgrading is not possible, consider implementing network segmentation to restrict SharePoint's access to internal resources. Implement strict input validation and output encoding within SharePoint applications to prevent malicious requests. Review and strengthen authentication mechanisms to limit the potential for attackers to gain initial access. Monitor SharePoint logs for suspicious activity, particularly requests to unusual or internal endpoints. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to block malicious requests.