What this checks: whether a Microsoft SharePoint host runs a version affected by unauth XML deserialization RCE. Read-only: it fingerprints Microsoft SharePoint and reads the version, no exploitation.
3. Detection — reads the Microsoft SharePoint version from the product's default response and version banner, compares to 16.0.10340.12101 (SharePoint 2019, KB4462199). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Microsoft SharePoint URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Microsoft SharePoint Server and sorts each host by whether its build falls below the CVE-2019-0604 floor. CVE-2019-0604 is unsafe XML deserialization that can lead to remote code execution on SharePoint. This check never posts XML and never triggers a deserializer. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /, fingerprints SharePoint from response markers, reads the MicrosoftSharePointTeamServices build, and compares it to 16.0.10340.12101 in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. An affected row is a build signal only.
Run it on a schedule when on-prem SharePoint farms lag on cumulative updates. A web front end that missed the 2019 fix build is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET / on each host and fingerprint SharePoint from response markers such as MicrosoftSharePointTeamServices.
Parse the build from MicrosoftSharePointTeamServices and compare it to the CVE-2019-0604 floor in the graph (16.0.10340.12101).
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether SharePoint was detected, the build read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of / only. No XML body and no deserialize POST.
Sample output
The records below are illustrative and do not come from a real run. They show one SharePoint host below the CVE-2019-0604 floor, one at or above 16.0.10340.12101, and one host that is not the product.
Builds below 16.0.10340.12101, the single floor coded in the graph. The compare uses the MicrosoftSharePointTeamServices value the / response itself served.
Does an affected row mean XML deserialization ran?
No. The check only GETs / and reads the build header. It does not post XML and it does not confirm RCE.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the site root. It does not authenticate or change farm state.
Does the check need credentials?
No. It fingerprints the public root response the way an external scanner would.
What is CVE-2019-0604?
Unsafe XML deserialization in Microsoft SharePoint Server that can lead to remote code execution. This workflow maps hosts to that CVE by unauthenticated build exposure only.