Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
This vulnerability is easy to exploit. An unauthenticated attacker can bypass authentication, escalate privileges, and gain control of a device, launching further attacks on the network.
Kill Chain
Risk Score
88
Administrators can enable Open Authorization version 2.0 (OAuth 2.0) on Microsoft SharePoint Server to authorize access to restricted pages. OAuth is a token-based workflow that enables third-party services to access restricted pages by exchanging tokens. When Oauth 2.0 is enabled, SharePoint has a token validation vulnerability that allows an attacker to bypass authentication and perform actions on the server. To exploit this vulnerability, the attacker sends the SharePoint server a malicious HTTP request with a forged JSON Web Token (JWT) to impersonate a system administrator. JWT is an open source industry standard for sharing information between clients and servers. The vulnerable SharePoint server validates the JWT and the attacker can install malware, run commands, or collect information.
