Security Updates for Microsoft SharePoint Server 2019 (October 2020) - Nessus
High Plugin ID: 141419This page contains detailed information about the Security Updates for Microsoft SharePoint Server 2019 (October 2020) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.
Plugin Overview
ID: 141419
Name: Security Updates for Microsoft SharePoint Server 2019 (October 2020)
Filename: smb_nt_ms20_oct_office_sharepoint_2019.nasl
Vulnerability Published: 2020-10-13
This Plugin Published: 2020-10-13
Last Modification Time: 2021-01-28
Plugin Version: 1.7
Plugin Type: local
Plugin Family: Windows : Microsoft Bulletins
Dependencies:
microsoft_sharepoint_installed.nbin, ms_bulletin_checks_possible.nasl, smb_hotfixes.nasl
Required KB Items [?]: SMB/MS_Bulletin_Checks/Possible
Vulnerability Information
Severity: High
Vulnerability Published: 2020-10-13
Patch Published: 2020-10-13
CVE [?]: CVE-2020-16941, CVE-2020-16942, CVE-2020-16944, CVE-2020-16945, CVE-2020-16946, CVE-2020-16948, CVE-2020-16950, CVE-2020-16951, CVE-2020-16952, CVE-2020-16953
CPE [?]: cpe:/a:microsoft:sharepoint_foundation, cpe:/a:microsoft:sharepoint_server
Synopsis
The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.
Description
The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :
- An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2020-16948, CVE-2020-16950, CVE-2020-16953)
- An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page. To take advantage of the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability. The security update addresses the vulnerability by correcting how scripts are referenced on some SharePoint pages. (CVE-2020-16941, CVE-2020-16942)
- A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. (CVE-2020-16951, CVE-2020-16952)
- This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions, delete content, steal sensitive information (such as browser cookies) and inject malicious content in the browser of the victim. For this vulnerability to be exploited, a user must click a specially crafted URL that takes the user to a targeted SharePoint Web App site. In an email attack scenario, an attacker could exploit the vulnerability by sending an email message containing the specially crafted URL to the user of the targeted SharePoint Web App site and convincing the user to click the specially crafted URL. (CVE-2020-16944)
- A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. (CVE-2020-16945, CVE-2020-16946)
Solution
Microsoft has released KB4486676 to address this issue.
Public Exploits
Target Network Port(s): 139, 445
Target Asset(s): Host/patch_management_checks
Exploit Available: True (Metasploit Framework, GitHub)
Exploit Ease: Exploits are available
Here's the list of publicly known exploits and PoCs for verifying the Security Updates for Microsoft SharePoint Server 2019 (October 2020) vulnerability:
- Metasploit: exploit/windows/http/sharepoint_ssi_viewstate
[Microsoft SharePoint Server-Side Include and ViewState RCE] - GitHub: https://github.com/pwntester/ysoserial.net
[CVE-2020-16952] - GitHub: https://github.com/whoadmin/pocs
[CVE-2020-16952]
Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.
WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.
Risk Information
CVSS Score Source [?]: CVE-2020-16952
CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C
| CVSS Base Score: | 6.8 (Medium) |
| Impact Subscore: | 6.4 |
| Exploitability Subscore: | 8.6 |
| CVSS Temporal Score: | 5.6 (Medium) |
| CVSS Environmental Score: | NA (None) |
| Modified Impact Subscore: | NA |
| Overall CVSS Score: | 5.6 (Medium) |
| CVSS Base Score: | 7.8 (High) |
| Impact Subscore: | 5.9 |
| Exploitability Subscore: | 1.8 |
| CVSS Temporal Score: | 7.2 (High) |
| CVSS Environmental Score: | NA (None) |
| Modified Impact Subscore: | NA |
| Overall CVSS Score: | 7.2 (High) |
STIG Risk Rating: High
Go back to menu.
Plugin Source
This is the smb_nt_ms20_oct_office_sharepoint_2019.nasl nessus plugin source code. This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
#
include('compat.inc');
if (description)
{
script_id(141419);
script_version("1.7");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/28");
script_cve_id(
"CVE-2020-16941",
"CVE-2020-16942",
"CVE-2020-16944",
"CVE-2020-16945",
"CVE-2020-16946",
"CVE-2020-16948",
"CVE-2020-16950",
"CVE-2020-16951",
"CVE-2020-16952",
"CVE-2020-16953"
);
script_xref(name:"MSKB", value:"4486676");
script_xref(name:"MSFT", value:"MS20-4486676");
script_xref(name:"IAVA", value:"2020-A-0460-S");
script_name(english:"Security Updates for Microsoft SharePoint Server 2019 (October 2020)");
script_set_attribute(attribute:"synopsis", value:
"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The Microsoft SharePoint Server 2019 installation on the
remote host is missing security updates. It is, therefore,
affected by multiple vulnerabilities :
- An information disclosure vulnerability exists when
Microsoft SharePoint Server fails to properly handle
objects in memory. An attacker who successfully
exploited this vulnerability could obtain information to
further compromise the users system. (CVE-2020-16948,
CVE-2020-16950, CVE-2020-16953)
- An information disclosure vulnerability exists when
Microsoft SharePoint Server improperly discloses its
folder structure when rendering specific web pages. An
attacker who took advantage of this information
disclosure could view the folder path of scripts loaded
on the page. To take advantage of the vulnerability, an
attacker would require access to the specific SharePoint
page affected by this vulnerability. The security update
addresses the vulnerability by correcting how scripts
are referenced on some SharePoint pages.
(CVE-2020-16941, CVE-2020-16942)
- A remote code execution vulnerability exists in
Microsoft SharePoint when the software fails to check
the source markup of an application package. An attacker
who successfully exploited the vulnerability could run
arbitrary code in the context of the SharePoint
application pool and the SharePoint server farm account.
Exploitation of this vulnerability requires that a user
uploads a specially crafted SharePoint application
package to an affected version of SharePoint. The
security update addresses the vulnerability by
correcting how SharePoint checks the source markup of
application packages. (CVE-2020-16951, CVE-2020-16952)
- This vulnerability is caused when SharePoint Server does
not properly sanitize a specially crafted request to an
affected SharePoint server. An authenticated attacker
could exploit this vulnerability by sending a specially
crafted request to an affected SharePoint server. The
attacker who successfully exploited this vulnerability
could then perform cross-site scripting attacks on
affected systems and run script in the security context
of the current user. These attacks could allow the
attacker to read content that the attacker is not
authorized to read, use the victim's identity to take
actions on the SharePoint site on behalf of the victim,
such as change permissions, delete content, steal
sensitive information (such as browser cookies) and
inject malicious content in the browser of the victim.
For this vulnerability to be exploited, a user must
click a specially crafted URL that takes the user to a
targeted SharePoint Web App site. In an email attack
scenario, an attacker could exploit the vulnerability by
sending an email message containing the specially
crafted URL to the user of the targeted SharePoint Web
App site and convincing the user to click the specially
crafted URL. (CVE-2020-16944)
- A cross-site-scripting (XSS) vulnerability exists when
Microsoft SharePoint Server does not properly sanitize a
specially crafted web request to an affected SharePoint
server. An authenticated attacker could exploit the
vulnerability by sending a specially crafted request to
an affected SharePoint server. The attacker who
successfully exploited the vulnerability could then
perform cross-site scripting attacks on affected systems
and run script in the security context of the current
user. The attacks could allow the attacker to read
content that the attacker is not authorized to read, use
the victim's identity to take actions on the SharePoint
site on behalf of the user, such as change permissions
and delete content, and inject malicious content in the
browser of the user. The security update addresses the
vulnerability by helping to ensure that SharePoint
Server properly sanitizes web requests. (CVE-2020-16945,
CVE-2020-16946)");
script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/en-us/help/4486676");
script_set_attribute(attribute:"solution", value:
"Microsoft has released KB4486676 to address this issue.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-16952");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/10/13");
script_set_attribute(attribute:"patch_publication_date", value:"2020/10/13");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/10/13");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_foundation");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows : Microsoft Bulletins");
script_copyright(english:"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("microsoft_sharepoint_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
script_require_keys("SMB/MS_Bulletin_Checks/Possible");
script_require_ports(139, 445, "Host/patch_management_checks");
exit(0);
}
include('smb_func.inc');
include('smb_hotfixes.inc');
include('smb_hotfixes_fcheck.inc');
include('smb_reg_query.inc');
include('misc_func.inc');
include('install_func.inc');
include('lists.inc');
get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');
bulletin = 'MS20-10';
kbs = make_list(
'4486676'
);
if (get_kb_item('Host/patch_management_checks'))
hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);
get_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);
# Get path information for Windows.
windir = hotfix_get_systemroot();
if (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');
registry_init();
install = get_single_install(app_name:'Microsoft SharePoint Server');
kb_checks =
{
'2019':
{ '0':
{'Server':
[{
'kb' : '4486676',
'path' : install['path'],
'append' : 'bin',
'file' : 'ascalc.dll',
'version' : '16.0.10367.20000',
'product_name' : 'Microsoft SharePoint Server 2019'
}]
}
}
};
# Get the specific product / path
param_list = kb_checks[install['Product']][install['SP']][install['Edition']];
# audit if not affected
if(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');
vuln = FALSE;
xss = FALSE;
port = kb_smb_transport();
# grab the path otherwise
foreach check (param_list)
{
if (!isnull(check['version']))
{
path = hotfix_append_path(path:check['path'], value:check['append']);
are_we_vuln = hotfix_check_fversion(
file:check['file'],
version:check['version'],
path:path,
kb:check['kb'],
product:check['product_name']
);
}
else
{
report = '\n';
if (check['product_name'])
report += ' Product : ' + check['product_name'] + '\n';
if (check['kb'])
report += ' KB : ' + check['kb'] + '\n';
hotfix_add_report(report, kb:check['kb']);
}
if(are_we_vuln == HCF_OLDER)
{
vuln = TRUE;
if (check['kb'] == '4486676') xss = TRUE;
}
}
if (vuln)
{
port = kb_smb_transport();
replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);
hotfix_security_warning();
hotfix_check_fversion_end();
exit(0);
}
else
{
hotfix_check_fversion_end();
audit(AUDIT_HOST_NOT, 'affected');
}
The latest version of this script can be found in these locations depending on your platform:
- Linux / Unix:
/opt/nessus/lib/nessus/plugins/smb_nt_ms20_oct_office_sharepoint_2019.nasl - Windows:
C:\ProgramData\Tenable\Nessus\nessus\plugins\smb_nt_ms20_oct_office_sharepoint_2019.nasl - Mac OS X:
/Library/Nessus/run/lib/nessus/plugins/smb_nt_ms20_oct_office_sharepoint_2019.nasl
Go back to menu.
How to Run
Here is how to run the Security Updates for Microsoft SharePoint Server 2019 (October 2020) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):
- Click to start a New Scan.
- Select Advanced Scan.
- Navigate to the Plugins tab.
- On the top right corner click to Disable All plugins.
- On the left side table select Windows : Microsoft Bulletins plugin family.
- On the right side table select Security Updates for Microsoft SharePoint Server 2019 (October 2020) plugin ID 141419.
- Specify the target on the Settings tab and click to Save the scan.
- Run the scan.
Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.
Basic usage:
/opt/nessus/bin/nasl smb_nt_ms20_oct_office_sharepoint_2019.nasl -t <IP/HOST>Run the plugin with audit trail message on the console:
/opt/nessus/bin/nasl -a smb_nt_ms20_oct_office_sharepoint_2019.nasl -t <IP/HOST>Run the plugin with trace script execution written to the console (useful for debugging):
/opt/nessus/bin/nasl -T - smb_nt_ms20_oct_office_sharepoint_2019.nasl -t <IP/HOST>Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):
/opt/nessus/bin/nasl -K /tmp/state smb_nt_ms20_oct_office_sharepoint_2019.nasl -t <IP/HOST>Go back to menu.
References
MSKB | Microsoft Knowledge Base: MSFT | Microsoft Security Bulletin:
- MS20-4486676
- 2020-A-0460-S
- https://www.tenable.com/plugins/nessus/141419
- https://support.microsoft.com/en-us/help/4486676
- https://vulners.com/nessus/SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL
- 141425 - Security Updates for Microsoft SharePoint Server 2013 (October 2020)
- 141436 - Security Updates for Microsoft SharePoint Server 2016 (October 2020)
- 142146 - Oracle JDeveloper XSS (October 2020 CPU)
- 141433 - KB4577668: Windows 10 Version 1809 and Windows Server 2019 October 2020 Security Update
- 141427 - KB4577671: Windows 10 Version 1903 and Windows 10 Version 1909 October 2020 Security Update
- 141423 - KB4579311: Windows 10 Version 2004 October 2020 Security Update
- 141424 - KB4580327: Windows 10 October 2020 Security Update
- 141420 - KB4580328: Windows 10 Version 1709 October 2020 Security Update
- 141422 - KB4580330: Windows 10 Version 1803 October 2020 Security Update
- 141431 - KB4580387: Windows 7 and Windows Server 2008 R2 October 2020 Security Update
- 141434 - KB4580346: Windows 10 Version 1607 and Windows Server 2016 October 2020 Security Update
- 141416 - KB4580358: Windows 8.1 and Windows Server 2012 R2 October 2020 Security Update
- 141432 - KB4580385: Windows Server 2008 October 2020 Security Update
- 141426 - KB4580353: Windows Server 2012 October 2020 Security Update
- 142595 - Microsoft Windows Codecs Library RCE (October 2020)
- 141428 - Security Updates for Outlook (October 2020)
Version
This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file smb_nt_ms20_oct_office_sharepoint_2019.nasl version 1.7. For more plugins, visit the Nessus Plugin Library.
Go back to menu.
