How to remediate – Microsoft SharePoint Exposed Web Services

1. Introduction

Microsoft SharePoint Exposed Web Services is a misconfiguration in Microsoft SharePoint Server that allows anonymous users to access the SharePoint web services page. This can allow attackers to gather information about the system and potentially exploit further vulnerabilities. Affected systems typically include on-premise installations of Microsoft SharePoint Server. A successful exploit could lead to information disclosure, impacting confidentiality.

2. Technical Explanation

The vulnerability occurs because of overly permissive access controls on SharePoint web services. An attacker does not need valid credentials to access these pages. The Common Weakness Enumeration (CWE) identifier for this issue is 200. An example attack involves an attacker directly accessing the web services URL, bypassing normal authentication mechanisms. Affected versions include those with default or poorly configured permissions.

• Root cause: Incorrectly configured anonymous access to SharePoint web services.
• Exploit mechanism: An attacker sends a request to the SharePoint web services endpoint without authentication.
• Scope: On-premise Microsoft SharePoint Server installations with misconfigured permissions.

3. Detection and Assessment

To confirm vulnerability, check access controls on the SharePoint web services page. A quick check involves attempting to access the page anonymously. For a thorough assessment, review SharePoint’s security configuration settings.

• Quick checks: Attempt to browse to the web services URL (e.g., https://yoursharepointserver/_vti_bin/webs.asmx) without logging in.
• Scanning: Nessus plugin ID 139258 may detect this issue, but results should be verified manually.
• Logs and evidence: Review IIS logs for requests to the /_vti_bin/webs.asmx endpoint from anonymous sources.

curl -I https://yoursharepointserver/_vti_bin/webs.asmx

4. Solution / Remediation Steps

Restrict anonymous access to Microsoft SharePoint configuration to resolve this issue. Follow these steps carefully.

4.1 Preparation

• No services need to be stopped for this change, but plan a maintenance window if possible.
• Roll back involves restoring the previous configuration settings.

4.2 Implementation

1. Step 1: Open Central Administration in SharePoint Server.
2. Step 2: Navigate to “Security” then “Authentication Providers”.
3. Step 3: Select your authentication provider (usually the default).
4. Step 4: Ensure that anonymous access is disabled for web services.
5. Step 5: If using claims-based authentication, review and restrict permissions on the Claims to Windows Token Service.

4.3 Config or Code Example

Before

Anonymous access allowed on web services endpoint.

After

Anonymous access disabled on web services endpoint. Authentication required for all requests.

4.4 Security Practices Relevant to This Vulnerability

Several security practices help prevent this issue. Least privilege reduces the impact of a successful exploit. Secure defaults ensure that systems start in a safe configuration. Regular patch cadence keeps SharePoint up-to-date with security fixes.

• Practice 1: Implement least privilege to limit access to sensitive resources.
• Practice 2: Enforce secure default configurations for all SharePoint settings.

4.5 Automation (Optional)

5. Verification / Validation

Confirm that anonymous access is no longer permitted. Re-run the earlier detection method and verify a 401 Unauthorized error. Perform a simple service smoke test by logging in as a regular user and accessing core SharePoint features.

• Post-fix check: Attempt to browse to https://yoursharepointserver/_vti_bin/webs.asmx again; you should receive a 401 Unauthorized error.
• Re-test: Repeat the curl command from section 3, confirming it now requires authentication.
• Monitoring: Monitor IIS logs for failed login attempts to the web services endpoint, which may indicate ongoing attacks.

curl -I https://yoursharepointserver/_vti_bin/webs.asmx

6. Preventive Measures and Monitoring

Update security baselines to include restrictions on anonymous access. Incorporate checks in CI or deployment pipelines to validate SharePoint configuration settings. Implement a regular patch cycle for SharePoint Server.

• Baselines: Update your SharePoint security baseline to enforce restricted anonymous access.
• Pipelines: Add automated tests that check the authentication settings during deployments.
• Asset and patch process: Review and apply SharePoint patches at least quarterly.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Incorrectly configured authentication may prevent legitimate users from accessing SharePoint.
• Roll back: Restore the previous SharePoint configuration settings from your backup.

8. References and Resources

• Vendor advisory or bulletin: https://mindedsecurity.com/wp-content/uploads/2020/10/Fedon_Athcon_June11.pdf
• NVD or CVE entry: No specific CVE is listed in the provided context.