Microsoft SharePoint 权限提升漏洞

攻击者利用此 SSRF 漏洞可以绕过内部网络访问控制，访问通常对外部用户隐藏的资源。这可能包括访问内部 API、数据库或管理界面。攻击者可以利用这些访问权限窃取敏感数据，例如用户凭据、财务信息或商业机密。更严重的后果是，攻击者可能利用此漏洞作为跳板，进一步渗透到内部网络，执行恶意代码或破坏系统。由于 SharePoint 经常被用于存储和共享敏感信息，因此此漏洞的潜在影响非常大。

Organizations heavily reliant on Microsoft SharePoint Enterprise Server for document management, collaboration, and internal applications are at significant risk. Environments with weak authentication controls or inadequate network segmentation are particularly vulnerable. Shared hosting environments where multiple tenants share the same SharePoint instance should also be carefully assessed.

• sharepoint: Examine SharePoint logs for unusual outbound requests, particularly those targeting internal IP addresses or services. Use PowerShell to check for suspicious scheduled tasks or web parts.

Get-SPOSite -Limit 1000 | Select-Object URL, Title

• generic web: Monitor access logs for requests to internal resources that should not be accessible from the outside. Check response headers for signs of SSRF exploitation.

curl -I <sharepoint_url> | grep -i 'X-SharePoint-Environment'

1. 2025-08-12Disclosure

   disclosure

1. 已保留2025-07-09
2. 发布日期2025-08-12
3. 修改日期2026-02-13
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即将 Microsoft SharePoint Enterprise Server 更新到修复版本 16.0.18526.20518 或更高版本。如果无法立即更新，可以考虑实施以下临时缓解措施：限制 SharePoint 应用程序的外部网络访问权限，使用网络防火墙阻止对敏感内部资源的访问，并实施严格的身份验证和授权控制。此外，监控 SharePoint 日志，查找可疑的网络请求，并配置 Web 应用程序防火墙 (WAF) 以检测和阻止 SSRF 攻击。