Zero Day Initiative - CVE-2024-30043: Abusing URL Parsing Confusion to Exploit XXE on SharePoint Server and Cloud

XXE vulnerability CVE-2024-30043 in SharePoint allows reading files, SSRF attacks, NTLM relaying, and other side effects, exploitable by low-privilege users.

BaseXmlDataSource in SharePoint allows Execute method with controlled URL/path strings, making it susceptible to XXE exploitation leading to Pwn2Own implications.

Read at Zero Day Initiative