Description

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:05.137Z",
  "pubdate": "2026-08-11T17:18:05.137Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Microsoft Office SharePoint, allowing an authorized attacker to execute spoofing attacks over a network.\nThe vulnerability exposes affected Microsoft Office SharePoint deployments to unauthorized interactions with internal or external resources via the server infrastructure.\nAn attacker leveraging this flaw can induce the vulnerable server to dispatch crafted HTTP requests to arbitrary destinations, potentially bypassing network boundary controls.\nExploitation requires authorization within the network and the ability to interact with the vulnerable component.\nThe primary risk implication involves network-based spoofing and unauthorized information disclosure or interaction facilitated by the SharePoint server.",
  "technicalDetails": "The vulnerability stems from improper validation of user-supplied URLs or input parameters within Microsoft Office SharePoint, which processes backend requests to external or internal endpoints.\nAn authenticated attacker initiates the attack flow by submitting a maliciously crafted request containing a targeted URI to the vulnerable SharePoint component.\nUpon receiving the input, the server fails to adequately sanitize or restrict the destination parameters before executing the outbound network connection.\nConsequently, the SharePoint server acts as a proxy, issuing requests on behalf of the attacker to arbitrary network locations over supported protocols.\nThe attack requires network access and specific authorization to interact with the vulnerable SharePoint interface, allowing the attacker to leverage the trust boundary of the server.\nPost-exploitation impact includes the potential to pivot into internal network segments, query metadata services, or perform spoofing attacks against connected infrastructure."
}