CVE-2014-2816

Vulnerability

The vulnerability resides in Microsoft SharePoint Server 2013 Gold and SP1, as well as SharePoint Foundation 2013 Gold and SP1. It allows a specially crafted app that uses a custom action to bypass sanitization, executing arbitrary JavaScript in the context of the current user on the SharePoint site. The issue is known as the "SharePoint Page Content Vulnerability" and is addressed in MS14-050 [1].

Exploitation

An attacker must be an authenticated user with permission to upload apps to a SharePoint site. They create a Trojan horse app containing a custom action with malicious JavaScript. When other users interact with the app, the script executes in their session, allowing the attacker to perform actions on their behalf [1].

Impact

Successful exploitation enables the attacker to run arbitrary JavaScript in the context of the victim user on the current SharePoint site. This can lead to data theft, session hijacking, or other unauthorized actions as the victim, effectively escalating the attacker's privileges [1].

Mitigation

Microsoft released security update MS14-050 on August 12, 2014, which corrects how SharePoint sanitizes specially crafted apps that use custom actions. Users should apply the update via Microsoft Update or manually. No workarounds are documented in the available references [1].