CVE-2024-10839

Q: What is the severity of CVE-2024-10839?

CVE-2024-10839 has a CVSS score of 8.5 (HIGH). This vulnerability allows authenticated attackers to perform XML External Entity (XXE) attacks through the Management option in ManageEngine SharePoint Manager Plus. Attackers could read sensitive files, conduct server-side request forgery, or potentially cause denial of service. Organizations running SharePoint Manager Plus versions 4503 and prior are affected.

8.5 HIGH

XXE

📋 TL;DR

This vulnerability allows authenticated attackers to perform XML External Entity (XXE) attacks through the Management option in ManageEngine SharePoint Manager Plus. Attackers could read sensitive files, conduct server-side request forgery, or potentially cause denial of service. Organizations running SharePoint Manager Plus versions 4503 and prior are affected.

💻 Affected Systems

Products:

Zohocorp ManageEngine SharePoint Manager Plus

Versions: 4503 and prior

Operating Systems: All supported platforms

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated access to the Management option. All deployments with vulnerable versions are affected regardless of configuration.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise including sensitive file disclosure, internal network reconnaissance, and potential remote code execution through XXE-based attacks.

🟠

Likely Case

Unauthorized access to sensitive files on the server, including configuration files, credentials, and system files, potentially leading to further lateral movement.

🟢

If Mitigated

Limited impact with proper network segmentation and file system permissions restricting what files can be accessed via XXE.

🌐 Internet-Facing: HIGH if the application is exposed to the internet, as authenticated attackers could exploit this remotely.

🏢 Internal Only: HIGH as authenticated users (including compromised accounts) can exploit this vulnerability from within the network.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once authentication is obtained. XXE vulnerabilities are well-understood and commonly exploited.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4504 or later

Vendor Advisory: https://www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html

Restart Required: Yes

Instructions:

1. Download the latest version (4504+) from the ManageEngine website. 2. Backup your current installation. 3. Stop the SharePoint Manager Plus service. 4. Install the updated version. 5. Restart the service.

🔧 Temporary Workarounds

Disable XML External Entity Processing

all

Configure the XML parser to disable external entity resolution

Modify XML parser configuration to set features like javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING to true

Restrict Access to Management Interface

all

Limit network access to the Management option using firewall rules or network segmentation

Configure firewall to restrict access to management port from trusted IPs only

🧯 If You Can't Patch

Implement strict network segmentation to isolate SharePoint Manager Plus from sensitive systems
Enforce least privilege access controls and monitor for suspicious authentication attempts

🔍 How to Verify

Check if Vulnerable:

Check the application version in the web interface or installation directory. Versions 4503 and below are vulnerable.

Check Version:

Check the version in the web interface at / or look for version information in installation files.

Verify Fix Applied:

Verify the application version is 4504 or higher after patching and test XXE payloads in the Management interface.

📡 Detection & Monitoring

Log Indicators:

Unusual XML parsing errors
Multiple failed authentication attempts followed by successful login
Access to sensitive file paths in logs

Network Indicators:

HTTP requests containing XML with external entity declarations to management endpoints
Outbound connections from the server to internal systems following XXE exploitation

SIEM Query:

source="sharepoint_manager_plus" AND (message="*XXE*" OR message="*DOCTYPE*" OR message="*ENTITY*")

📊 Metadata

CVE ID: CVE-2024-10839

CVSS v3 Score: 8.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

CWE: CWE-611

Published: November 8, 2024

Last Updated: November 13, 2024

🔗 References

https://www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp

Manageengine Sharepoint Manager Plus by Zohocorp