Description

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:19:10.393Z",
  "pubdate": "2026-08-11T17:19:10.393Z",
  "executiveSummary": "This vulnerability is classified as a Server-Side Request Forgery (SSRF) security flaw affecting Microsoft Office SharePoint. The vulnerability enables an authorized network attacker to induce the server-side application into making arbitrary HTTP requests to unintended locations, ultimately leading to a privilege escalation condition. The impact of successful exploitation includes unauthorized access to internal resources, potential extraction of sensitive system data, and elevation of operational privileges within the network architecture. The affected systems are instances of Microsoft Office SharePoint. Exploitation requires the attacker to possess prior authorization to interact with the SharePoint environment, lowering the barrier for internal threat actors or compromised accounts. Risk implications are severe, as an attacker can leverage the SSRF primitive to pivot deeper into internal network segments that are normally isolated from external access, bypassing standard perimeter defenses. Attack requirements dictate that the malicious actor must have network connectivity to the vulnerable SharePoint server and valid credentials to authenticate to the application layer. No further exploitation vectors are explicitly required beyond the ability to craft and submit malicious requests that the SharePoint server processes improperly.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation and sanitization within Microsoft Office SharePoint when handling user-supplied URLs or external resource references. The vulnerable component processes network requests originating from user input without adequately restricting the destination IP addresses, domains, or URL schemes. Consequently, the server acts as an inadvertent proxy, forwarding requests to internal services, loopback interfaces, or external endpoints depending on the attacker's payload.\nExploitation occurs via the following step-by-step attack flow: First, the authenticated attacker crafts a malicious HTTP request containing a targeted internal or external URL embedded within a parameter processed by SharePoint's server-side logic. Second, the attacker transmits this payload over the network to the vulnerable Microsoft Office SharePoint endpoint. Third, upon receiving the request, the SharePoint application fails to validate or restrict the destination URI, passing the request down to its internal HTTP client library. Fourth, the server initiates an outbound connection to the specified target address on behalf of the application.\nThrough this payload behavior, the attacker can interact with backend services, metadata endpoints, or administrative interfaces that are restricted from direct network access. The post-exploitation impact includes the retrieval of sensitive environment configuration data, internal service interaction, and the potential chaining of the SSRF vector with other internal vulnerabilities to achieve full privilege escalation and administrative control over the affected infrastructure. Authentication is required to interact with the vulnerable application, and the attacker must possess network exposure to the SharePoint instance."
}