Loading vulnerability…
A critical remote code execution vulnerability in Microsoft SharePoint caused by improper validation of the source markup of a SharePoint application package. SharePoint fails to correctly check the source markup when processing an uploaded application package, allowing a specially crafted package to trigger code execution. Successful exploitation enables arbitrary code execution in the security context of the SharePoint application pool and the SharePoint server farm account. The vulnerability has also been described in reporting as involving an XML deserialization component within SharePoint, and it has been widely used as an initial access vector to deploy web shells and follow-on malware on exposed SharePoint servers.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a Python exploit script (cve-2019-0604-exp.py) targeting Microsoft SharePoint servers vulnerable to CVE-2019-0604, a remote code execution flaw. The exploit works by sending crafted requests to the SharePoint Picker.aspx endpoint, leveraging the vulnerability to upload a web shell (ua.aspx) to the server. Once the shell is uploaded, the script attempts to access it to verify successful exploitation. The main file is a standalone Python script, and the only other file is a README with references to further documentation. The exploit requires the attacker to provide the base URL of the target SharePoint instance. The script is operational and provides a working web shell if the target is vulnerable.
This repository is a proof-of-concept exploit for CVE-2019-0604, a remote code execution vulnerability in Microsoft SharePoint. The main code is in 'ConsoleApplication1/ConsoleApplication1/Program.cs', a C# console application that demonstrates how a malicious XAML file (t.xml) can be used to trigger code execution via SharePoint's deserialization of XAML. The exploit leverages the 'ObjectDataProvider' in XAML to launch arbitrary commands (e.g., 'cmd.exe /c calc'). The repository includes the XAML payload (t.xml) and the C# code that loads and executes it, simulating the vulnerable SharePoint behavior. No network endpoints or hardcoded IPs are present, but the attack vector is network-based, targeting SharePoint servers that process attacker-supplied XAML. The exploit is a POC and does not include weaponized or automated exploitation scripts.
This repository is a weaponized exploit for CVE-2019-0604, a critical remote code execution vulnerability in Microsoft SharePoint. The main exploit logic is in 'exploit.py', which automates the exploitation process, supporting both direct command execution and file upload (such as webshells) to the target SharePoint server. The exploit can operate in both authenticated and unauthenticated modes, depending on the target's configuration. It supports out-of-band (OOB) exfiltration of command output via DNS or HTTP channels, integrating with services like Burp Collaborator or requestbin.net. The payloads are serialized XAML objects that trigger the vulnerability, and the repository includes helper scripts for request parsing, payload generation, and OOB data handling. The structure is modular, with separate files for SharePoint-specific payload crafting ('sharepointkit.py'), OOB handling ('oob/collab_handler.py', 'oob/decoder.py'), and a sample PowerShell webshell ('oob/payload.ps1'). The exploit is operational and can be used to gain remote code execution, upload arbitrary files, and retrieve output from the target system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft SharePoint vulnerability exploited by VOID MANTICORE/HomeLand Justice for initial access via public-facing SharePoint servers.
A Microsoft SharePoint vulnerability used by Scarred Manticore to establish initial access before handing operations off to Handala/Void Manticore.
A historical SharePoint remote code execution vulnerability mentioned only as background context for SharePoint exploitation history.
A remote code execution vulnerability in Microsoft SharePoint Server that was exploited to compromise SharePoint servers and deploy web shells in a separate historic intrusion.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.