CVE-2010-0716

Vulnerability

The _layouts/Upload.aspx endpoint in the Documents module of Microsoft SharePoint before 2010 uses the same hostname and port for primary website files and individual user uploads. This design allows remote authenticated users to exploit same-origin relationships by uploading a specially crafted TXT file, leading to cross-site scripting (XSS). The vulnerability affects all SharePoint versions prior to the 2010 release.

Exploitation

An attacker must be an authenticated user of the SharePoint site. No additional privileges or user interaction are required. The attacker uploads a malicious TXT file containing JavaScript code via the Upload.aspx page. When other users access the uploaded file, the script executes in the context of the SharePoint site.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any user viewing the malicious file. This can lead to data theft, session hijacking, or defacement within the SharePoint site's security context.

Mitigation

Microsoft recommends upgrading to SharePoint 2010, which introduces cross-domain isolation to prevent this attack. The vendor disputes the severity, noting that organizations can implement additional cross-domain isolation measures. No official workaround or patch for earlier versions has been provided.