CVE-2012-1860

Vulnerability

CVE-2012-1860, disclosed in Microsoft Security Bulletin MS12-050 [1], is a permission-checking flaw in Microsoft Office SharePoint Server 2007 Service Pack 2 and Service Pack 3, SharePoint Server 2010 Gold and Service Pack 1, and Office Web Apps 2010 Gold and Service Pack 1. The vulnerability occurs because these products do not properly validate permissions when processing search-scope parameters in URLs. An authenticated user with access to a search scope can modify a parameter in the search-scope URL, leading to unauthorized data disclosure or data modification.

Exploitation

An attacker must be an authenticated user with access to the SharePoint site. The exploitation involves crafting a specially crafted URL that modifies a search-scope parameter. This URL can be delivered via email, instant message, or other means, tricking a user with sufficient privileges into clicking it. Alternatively, the attacker could directly craft the URL if they have the necessary permissions. The attack does not require any special network position beyond typical SharePoint access.

Impact

Successful exploitation allows an attacker to view or modify data that they would not normally be authorized to access, potentially leading to sensitive information disclosure. Additionally, the attacker could cause data modification, resulting in denial of service or corruption of SharePoint content. The impact is limited to data that is searchable within the scope, but this could include confidential documents or site content.

Mitigation

Microsoft released security update MS12-050 [1] on July 10, 2012, addressing this vulnerability. For SharePoint Server 2007, the update is included in cumulative update packages; for SharePoint Server 2010 and Office Web Apps 2010, the update is part of the July 2012 cumulative update. Administrators should apply the appropriate update to affected systems. No workaround is documented, as the fix involves correcting the permission validation logic. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of this writing.