Rule Document 1:66783

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Microsoft SharePoint elevation of privilege attempt

Rule Explanation

This rule looks for attempts to abuse ToolPane requests via WebPart additions to execute code remotely on a SharePoint system, enabling privilege escalation or in other cases further system compromise.

What To Look For

This rule alerts on attempts to exploit a URI pathing authentication bypass in Microsoft SharePoint.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group