Exploit for Unrestricted Upload of File with Dangerous Type in Progress Sitefinity CVE-2023-29375

## https://sploitus.com/exploit?id=C3B5F53F-DE9A-5C59-9BCD-136044C91963
# SOC Incident Analysis: Microsoft SharePoint Server Elevation of Privilege (CVE-2023-29375)

An in-depth security investigation of a critical exploit and enumeration attempt targeting a Microsoft SharePoint server.

## Incident Overview
- **Alert Name:** SOC227 - Microsoft SharePoint Server Elevation of Privilege - Possible CVE-2023-29375 Exploitation
- **Severity:** Critical
- **Date/Time:** October 6, 2023, 08:05 PM
- **Target Hostname:** MS-SharePointServer
- **Target IP / Port:** `172.16.17.233:443` (HTTPS)
- **Source IP (Attacker):** `39.91.166.222`
- **User-Agent:** `python-requests/2.28.1`
- **Device Action:** Permitted / Allowed

![Alert Overview](screenshots/alert-overview.png)

---

## Technical Investigation & Findings
1. **Initial Detection & Automation:** The SIEM triggered a critical alert (`SOC227`) identifying automated enumeration and privilege escalation attempts against SharePoint API endpoints utilizing a Python-based script (`python-requests/2.28.1`).
2. **API Endpoint Probing & Response Analysis:**
   - Request to `/_api/web/siteusers/web/siteusers` resulted in an **HTTP 404 (Not Found)** response (Response Size: `1453` bytes).
   - Subsequent request to `/_api/web/currentuser` resulted in an **HTTP 200 (OK)** response (Response Size: `1071` bytes), indicating successful session context retrieval by the attacker.

![Firewall Traffic](screenshots/firewall-traffic.png)

3. **Threat Intelligence Correlation:** Cross-referencing the attacker's IP (`39.91.166.222`) on VirusTotal confirmed it is flagged by multiple security vendors as malicious (Associated with ASN 4837, China Unicom).

![VirusTotal Analysis](screenshots/virustotal-analysis.png)