Critical Vulnerability in Microsoft SharePoint Threatens National Security Agencies

Hackers are actively exploiting a recently uncovered zero-day vulnerability in Microsoft’s SharePoint Server software. This software plays a critical role in the operations of several key U.S. government agencies, notably those involved in national security.

The vulnerability specifically impacts on-premises versions of SharePoint. This flaw enables attackers to infiltrate systems, steal sensitive data, and move laterally through interconnected services. While the cloud-based version is secure, the prevalence of the on-premises version among government entities, educational institutions, and private businesses puts many systems at significant risk.

Zero-Day Exploit Details

The exploit was first reported by cybersecurity agency Eye Security on July 18. According to researchers, this zero-day vulnerability arises from a previously unknown chain of flaws. Attackers can gain complete control over vulnerable SharePoint servers without requiring any login credentials. This enables them to steal machine keys used for signing authentication tokens, allowing them to impersonate legitimate users or services even after the system has been patched or rebooted.

Eye Security has linked this exploit to two bugs highlighted during the Pwn2Own security conference held earlier this year. This means that while the methods were initially presented as proof-of-concept demonstrations, malicious actors have now weaponized the technique to target real-world organizations. The exploit is referred to as “ToolShell.”

Risks Associated with the Exploit

Once hackers gain access to a compromised SharePoint server, they can infiltrate associated Microsoft services such as Outlook, Teams, and OneDrive. This broad access brings a considerable amount of corporate data into jeopardy. Furthermore, it grants attackers the means to establish long-term access to the systems. By acquiring cryptographic material that signs authentication tokens, they can maintain access even after a patch is applied.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been proactive in warning organizations about this threat. CISA advocates for immediate action to check for signs of compromise and isolate vulnerable servers from internet exposure.

Widespread Impact and Response

Initial assessments identified around 100 victims of the exploit. However, further investigations have revealed that over 400 SharePoint servers worldwide have been compromised. It’s important to note that this figure refers to the servers themselves, and the number of affected organizations may be larger. Among the most notable targets is the National Nuclear Security Administration (NNSA), which has confirmed being targeted, although Microsoft has not verified whether a breach occurred.

Additional government entities affected include the Department of Education, Florida’s Department of Revenue, and the Rhode Island General Assembly.

Microsoft has acknowledged the zero-day vulnerability and is aware of ongoing attacks exploiting this flaw. As a response, the company has promptly released patches for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Subscription Edition. Patches for all supported versions of on-premises servers were available as of July 21.

Immediate Steps for Organizations

If your organization relies on its own SharePoint servers, particularly older on-premises versions, you must take the following actions to mitigate risks:

1. Disconnect Vulnerable Servers

Quickly take unpatched SharePoint servers offline to avoid potential exploitation.

2. Apply Available Updates

Immediately implement Microsoft’s emergency patches for SharePoint Server 2016, 2019, and Subscription Edition without delay.

3. Rotate Authentication Keys

Change all machine keys used for signing authentication tokens, as these could have been compromised, enabling ongoing access.

4. Scan for Signs of Compromise

Conduct thorough checks for unauthorized access, tracking abnormal login patterns or token misuse.

5. Enable Security Logging

Activate detailed logging and monitoring to capture any unusual activity moving forward.

6. Review Connected Services

Evaluate access to Outlook, Teams, and OneDrive for suspicious behaviors related to the SharePoint vulnerability.

7. Subscribe to Threat Alerts

Stay informed by signing up for advisories from CISA and Microsoft to receive updates on patches and emerging threats.

8. Consider Migration to Cloud

Whenever feasible, transition to SharePoint Online, which inherently features stronger security measures and automatic updates.

9. Strengthen Password Security and Use Two-Factor Authentication

Encourage all employees to be vigilant. Although the exploit primarily targets organizations, it serves as a crucial reminder to enable two-factor authentication and utilize robust passwords. Using a password manager can simplify the process and enhance security.

This zero-day vulnerability in SharePoint illustrates the swift shift from research to real-world threats. What began as a proof-of-concept demonstration now poses a substantial risk to numerous systems, including significant government sectors. The alarming reality is not only the level of access granted but also how easily hackers can maintain their presence, remaining undetected even after systems are secured.

Your Thoughts Matter

Would stricter regulations surrounding the use of secure software in governmental operations improve national security? Share your opinions by reaching out to us.

Critical Vulnerability in Microsoft SharePoint Threatens National Security Agencies