---
title: "SharePoint CVE-2024-38094: Site Owner RCE, Exploited"
url: https://erroneo.us/security/briefs/sharepoint-cve-2024-38094-deserialization-rce/
description: "A July 2024 SharePoint Server RCE needing Site Owner rights was used for initial access in a domain takeover. Confirm farm builds and hunt for webshells."
type: security-brief
section: "Security Digest"
date_published: 2024-07-09
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-38094"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SharePoint CVE-2024-38094: Site Owner RCE, Exploited

**Verdict: Check exposure.** Fixed in July 2024 and exploited since; any on-premises farm patched in the last two years is safe from this bug, so the work is confirming builds and hunting for footholds on farms that lagged.

- **Who must act:** Owners of on-premises SharePoint Server 2016, 2019 or Subscription Edition farms that missed the July 2024 updates, especially farms reachable from the internet with many site owners.
- **Who can relax:** SharePoint Online (Microsoft 365) customers, and on-premises teams that have applied cumulative updates since July 2024 and saw no suspicious activity before then.
- **Affected:** SharePoint Server Subscription Edition before 16.0.17328.20424; SharePoint Server 2019 before 16.0.10412.20001; SharePoint Enterprise Server 2016 before 16.0.5456.1000
- **Fixed:** KB5002606 (Subscription Edition, build 16.0.17328.20424); KB5002615 (SharePoint Server 2019, build 16.0.10412.20001); KB5002618 (SharePoint Enterprise Server 2016, build 16.0.5456.1000); Any later cumulative update
- **CVEs:** CVE-2024-38094
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run (Get-SPFarm).BuildVersion on every farm and compare it with the fixed builds for your edition.
2. Install the current SharePoint security update; later SharePoint bugs, including ToolShell, are also in KEV.
3. Review who holds Site Owner or Full Control rights and remove stale or shared accounts.
4. Keep SharePoint off the open internet or behind an authenticating reverse proxy or VPN.
5. If a farm stayed unpatched past October 2024, hunt for webshells and domain-level activity before closing the issue.

### How to check if you are affected

- Search IIS logs for POSTs to /_vti_bin/client.svc/ that reference BusinessDataMetadataCatalog, and for /_vti_bin/DelveApi.ashx/config/ paths ending in .aspx.
- Look for unexpected .aspx files in the SharePoint web root, such as the ghostfile93.aspx webshell Rapid7 found.
- Alert on w3wp.exe spawning cmd.exe or powershell.exe on SharePoint servers.
- Check servers for tools staged in C:\ProgramData\VMware\, a Fast Reverse Proxy binary run by scheduled task, or the Huorong driver sysdiag_win10.sys.

## What happened

On July 9, 2024, Microsoft patched CVE-2024-38094, a remote code execution bug in on-premises SharePoint Server. It is a deserialization of untrusted data flaw (CWE-502). The [Microsoft advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094) rates it Important, CVSS 3.1 7.2. Its FAQ says "an authenticated attacker with Site Owner permissions can use the vulnerability to inject arbitrary code and execute this code in the context of SharePoint Server." At release, Microsoft said the bug was not publicly disclosed or exploited, and rated exploitation "more likely."

A public proof of concept followed. On October 22, 2024, CISA [added](https://www.cisa.gov/news-events/alerts/2024/10/22/cisa-adds-one-known-exploited-vulnerability-catalog) the CVE to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38094) "based on evidence of active exploitation." The entry marks known use in ransomware campaigns, with a November 12 federal deadline.

On October 30, 2024, [Rapid7](https://www.rapid7.com/blog/post/2024/10/30/investigating-a-sharepoint-compromise-ir-tales-from-the-field/) described an incident that began with this bug on an on-premises SharePoint server. Two POST requests stood out in the logs. The first matched public proof-of-concept code. The second created a webshell named `ghostfile93.aspx`. The attacker went undetected for two weeks and compromised the entire domain, using an Exchange service account with domain admin rights. Rapid7 lists Mimikatz, Impacket, Fast Reverse Proxy, kerbrute, Certify and NTDSUtil, and says the attacker installed Huorong antivirus to disrupt existing security tools. A later attempt to destroy third-party backups failed.

## Who is affected

On-premises SharePoint Server only. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-38094) lists Subscription Edition before 16.0.17328.20424, SharePoint Server 2019 before 16.0.10412.20001 and SharePoint Enterprise Server 2016 before 16.0.5456.1000. The fixes are KB5002606, KB5002615 and KB5002618. SharePoint Online is not listed.

## Do you really need to act?

The precondition matters. An attacker needs a Site Owner account first. In practice that bar is lower than it sounds. Large farms often have many site owners, and phished or reused credentials are common. The bug is also not "automatable" in CISA's enrichment, so this is targeted intrusion work, not mass scanning.

Any farm on a cumulative update from July 2024 or later is fixed. The verdict today is check exposure. A farm still below these builds has a bigger problem. It is also open to later SharePoint bugs in KEV, including ToolShell (CVE-2025-53770, added July 20, 2025) and several 2026 entries. A farm that lagged into late 2024 also needs a compromise check, because patching does not remove a webshell.

## What to do now

1. In the SharePoint Management Shell, run `(Get-SPFarm).BuildVersion` on each farm and compare it with the fixed builds above.
2. Install the current SharePoint security update, not just the July 2024 one.
3. Audit Site Owner and Full Control grants. Remove stale, shared and service accounts that do not need them, and require MFA where SharePoint uses federated sign-in.
4. Keep SharePoint off the open internet, or put it behind a VPN or an authenticating reverse proxy.
5. If a farm was unpatched after October 2024, run the hunt below and treat any hit as a domain compromise.

## How to tell if you were hit

- Search IIS logs: `Select-String -Path C:\inetpub\logs\LogFiles\W3SVC*\*.log -Pattern 'BusinessDataMetadataCatalog','DelveApi.ashx/config'`. Rapid7 saw both patterns in the attack requests.
- List recently changed `.aspx` files in the SharePoint web root and layouts folders. Investigate anything you did not deploy.
- Review EDR telemetry for `w3wp.exe` launching `cmd.exe` or `powershell.exe`.
- Check for tools in `C:\ProgramData\VMware\`, scheduled tasks running a proxy binary, the Huorong driver `sysdiag_win10.sys`, and odd 4624 logons on domain controllers.

## Timeline

- Jul 9, 2024 — Microsoft releases fixes and publishes the advisory.
- Oct 22, 2024 — CISA adds CVE-2024-38094 to KEV with known ransomware use.
- Oct 30, 2024 — Rapid7 publishes its incident write-up.
- Nov 12, 2024 — Federal remediation deadline.

## Sources

1. [Microsoft — CVE-2024-38094: Microsoft SharePoint Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094)
2. [CVE record — CVE-2024-38094](https://www.cve.org/CVERecord?id=CVE-2024-38094)
3. [NVD — CVE-2024-38094](https://nvd.nist.gov/vuln/detail/CVE-2024-38094)
4. [CISA — Known Exploited Vulnerabilities: CVE-2024-38094](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38094)
5. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Oct 22, 2024)](https://www.cisa.gov/news-events/alerts/2024/10/22/cisa-adds-one-known-exploited-vulnerability-catalog)
6. [Rapid7 — Investigating a SharePoint Compromise: IR Tales from the Field](https://www.rapid7.com/blog/post/2024/10/30/investigating-a-sharepoint-compromise-ir-tales-from-the-field/)

---
Source page: https://erroneo.us/security/briefs/sharepoint-cve-2024-38094-deserialization-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt