支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 525da2cb343431e124a06f839f3a942804055629

来源
https://github.com/W01fh4cker/CVE-2024-30043-XXE
关联漏洞
标题:Microsoft SharePoint 代码问题漏洞 (CVE-2024-30043)
Description:Microsoft SharePoint是美国微软（Microsoft）公司的一套企业业务协作平台。该平台用于对业务信息进行整合，并能够共享工作、与他人协同工作、组织项目和工作组、搜索人员和信息。 Microsoft Office SharePoint存在代码问题漏洞。以下产品和版本受到影响：Microsoft SharePoint Enterprise Server 2016,Microsoft SharePoint Server 2019,Microsoft SharePoint Server Sub
Description
Exploiting XXE Vulnerabilities on Microsoft SharePoint Server and Cloud via Confused URL Parsing
介绍
# CVE-2024-30043-XXE
# Credit

The impact of the vulnerability is limited at present, but thanks to https://x.com/chudyPB for providing a clever bypass idea.

>https://x.com/chudyPB

> https://www.zerodayinitiative.com/blog/2024/5/29/cve-2024-30043-abusing-url-parsing-confusion-to-exploit-xxe-on-sharepoint-server-and-cloud

>https://x.com/chudyPB/status/1797707100421751007

# Usage

change these:

![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240607023526043.png)

```shell
pip install requests requests_ntlm flask
python CVE-2024-30043-XXE.py
```

test on `Microsoft Sharepoint Server 2019`(`16.0.10409.20027`):

![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240607023535435.png)
文件快照

 [4.0K]  /data/pocs/525da2cb343431e124a06f839f3a942804055629
├── [6.4K]  CVE-2024-30043-XXE.py
└── [ 727]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。