Description

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-07T00:16:41.040Z",
  "pubdate": "2026-08-07T00:16:41.040Z",
  "executiveSummary": "This vulnerability assessment addresses a Server-Side Request Forgery (SSRF) security flaw identified in Microsoft Office SharePoint. Server-Side Request Forgery vulnerabilities occur when an application fails to adequately validate user-supplied URLs or input parameters before initiating outbound network requests to internal or external resources.\nThe primary impact of this vulnerability involves the potential for unauthorized attackers to perform network spoofing, potentially leveraging the trust relationship of the underlying server infrastructure to interact with internal network services that are otherwise inaccessible from the external perimeter.\nThe affected product is Microsoft Office SharePoint. Based on the provided threat intelligence, the vulnerability can be exploited by an unauthorized remote attacker over a network without requiring prior authentication, lowering the overall complexity of potential network-based exploitation scenarios.\nRisk implications include potential exposure of internal topology, unauthorized data access, and the execution of arbitrary requests originating from the trusted host context of the SharePoint server. Organizations utilizing the affected Microsoft Office SharePoint deployments face increased exposure to reconnaissance and pivoting activities if exploitation is successful.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling and lack of strict sanitization of user-controlled input intended for server-side HTTP or network request generation within Microsoft Office SharePoint.\nThe vulnerable component processes input parameters that dictate where the server establishes outbound connections. When an attacker supplies a crafted URL or payload, the server fails to restrict the destination to expected endpoints, permitting redirection or direct querying of arbitrary network locations.\nExploitation occurs over a network vector without requiring authentication, allowing an unauthorized attacker to interact directly with the vulnerable SharePoint service. The attack flow proceeds as follows: First, the attacker crafts a malicious request containing a targeted internal or external URI within the vulnerable parameter. Second, the Microsoft Office SharePoint server accepts the input and initiates a server-side request to the specified destination without sufficient validation or restriction of the target IP address or protocol schema.\nPayload behavior during an SSRF exploit typically involves directing the SharePoint server to query loopback interfaces (127.0.0.1), local service ports, or internal network segments (such as private RFC 1918 address spaces) that are shielded by perimeter firewalls. Because the request originates from the SharePoint server itself, internal services often implicitly trust the traffic, potentially disclosing sensitive metadata, internal application responses, or administrative endpoints.\nThe network exposure is remote, and the privilege requirements are minimal, as the input vector is accessible to unauthorized entities over the network interface exposed by the application. Post-exploitation impact encompasses network spoofing, potential information disclosure of internal resources, and the facilitation of secondary attacks targeting internal services accessible from the SharePoint host."
}