Urgent: Microsoft SharePoint Servers Under Active Attack! Patch Now!

Microsoft SharePoint is under siege! A major security flaw is being actively exploited by hackers, putting thousands of on-premises servers at risk. This affects businesses and agencies worldwide using Microsoft SharePoint for collaboration and document management.

Microsoft has issued an urgent alert regarding these active attacks, confirming they’re working on a patch for this zero-day exploit. This blog post breaks down what you need to know and what steps you should take to protect your data.

The SharePoint Vulnerability: What’s Happening?

Researchers at Eye Security discovered the vulnerability on July 18th. Here’s the critical information:

• Impact: Hackers can access on-premises SharePoint servers and steal keys. These keys allow them to impersonate users or services, even after a reboot or patch.
• Risk: Servers already compromised remain a risk. Cloud versions of SharePoint are not affected.
• Exploitation: The zero-day exploit allows attackers to steal sensitive data, harvest passwords, and move laterally across the network.
• Attack Vectors: Services connected to SharePoint, such as Outlook, Teams, and OneDrive, are also at risk.

The exploit seems to stem from a combination of bugs presented at the Pwn2Own hacking contest in May. This allows unauthenticated access to SharePoint servers, making it incredibly dangerous.

What Versions of SharePoint are Affected?

• SharePoint 2019
• SharePoint Subscription Edition
• SharePoint 2016 (Patch in progress)

Immediate Actions to Take

Microsoft has released patches to fully protect SharePoint 2019 and SharePoint Subscription Edition servers. They are actively working on a patch for SharePoint 2016.

Here’s what you need to do right now:

1. Apply the Patch: Immediately install the latest security updates for your SharePoint servers. You can find the patches on the Microsoft Security Response Center blog.
2. Investigate for Compromise: Check your servers for any signs of unauthorized access or suspicious activity. Look for unusual logins, file modifications, or network traffic.
3. Isolate Affected Servers: The US Cybersecurity and Infrastructure Security Agency (CISA) recommends disconnecting impacted servers from the internet until a resolution is available. This will prevent further exploitation.
4. Monitor Network Traffic: Keep a close eye on network traffic for any suspicious activity. Look for unusual connections or data transfers.

The Bigger Picture: Why This Matters

This SharePoint vulnerability is a stark reminder of the importance of proactive security measures. Even with robust security protocols, zero-day exploits can still pose a significant threat. It also highlights the importance of keeping software up to date and regularly monitoring systems for suspicious activity.

This isn’t just about Microsoft. It’s about the entire tech ecosystem. When a widely used platform like SharePoint is compromised, it can have cascading effects across numerous organizations.

Actionable Takeaway

Don’t wait! Patch your SharePoint servers immediately! This is the single most important step you can take to protect your data and your organization.

Expert Commentary (Simulated)

“This SharePoint exploit is particularly dangerous because it allows attackers to maintain access even after a patch is applied,” says Jane Doe, a cybersecurity expert at CyberSafe Solutions. “Organizations need to not only apply the patch but also thoroughly investigate their systems for signs of compromise.”

FAQ

Q: Am I affected if I use SharePoint Online? A: No, the cloud version of SharePoint is not vulnerable to this exploit.

Q: Where can I find the security patches? A: You can find the patches on the Microsoft Security Response Center blog.

Q: What are the signs of a compromised server? A: Look for unusual logins, file modifications, suspicious network traffic, and any other anomalous activity.

Q: What if I can’t patch my servers immediately? A: Disconnect the servers from the internet until you can apply the patch. This will prevent further exploitation.

Key Takeaways

• A major security flaw is affecting on-premises Microsoft SharePoint servers.
• Hackers are actively exploiting this vulnerability to steal data and compromise systems.
• Microsoft has released patches for SharePoint 2019 and SharePoint Subscription Edition, and is working on a patch for SharePoint 2016.
• Organizations must apply the patches immediately and investigate for signs of compromise.
• Disconnecting affected servers from the internet can prevent further exploitation.

Stay vigilant and keep your systems secure!

---

Source: The Verge