---
title: "SharePoint XML RCE (CVE-2019-0604)"
canonical: https://trickest.com/library/cve-2019-0604-sharepoint-xml-deserialization-rce
description: "Flag SharePoint hosts for CVE-2019-0604 by reading MicrosoftSharePointTeamServices on GET /. Floor is 16.0.10340.12101. No XML deserialize POST."
---

# SharePoint XML RCE (CVE-2019-0604)

## Overview

This workflow finds Microsoft SharePoint Server and sorts each host by whether its build falls below the CVE-2019-0604 floor. CVE-2019-0604 is unsafe XML deserialization that can lead to remote code execution on SharePoint. This check never posts XML and never triggers a deserializer. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/`, fingerprints SharePoint from response markers, reads the `MicrosoftSharePointTeamServices` build, and compares it to 16.0.10340.12101 in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a build signal only.

Run it on a schedule when on-prem SharePoint farms lag on cumulative updates. A web front end that missed the 2019 fix build is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/` on each host and fingerprint SharePoint from response markers such as `MicrosoftSharePointTeamServices`.
3. Parse the build from `MicrosoftSharePointTeamServices` and compare it to the CVE-2019-0604 floor in the graph (16.0.10340.12101).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether SharePoint was detected, the build read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/` only. No XML body and no deserialize POST.

## Sample output

The records below are illustrative and do not come from a real run. They show one SharePoint host below the CVE-2019-0604 floor, one at or above 16.0.10340.12101, and one host that is not the product.

```jsonl
{"url": "https://intranet.example.com", "is_product": true, "product_version": "16.0.10340.12100", "vulnerable": true, "detail": "below floor 16.0.10340.12101"}
{"url": "https://intranet.example.org", "is_product": true, "product_version": "16.0.10340.12101", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Microsoft SharePoint"}
```

```json
{"cve": "CVE-2019-0604", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which SharePoint versions does this flag?

Builds below 16.0.10340.12101, the single floor coded in the graph. The compare uses the `MicrosoftSharePointTeamServices` value the `/` response itself served.

### Does an affected row mean XML deserialization ran?

No. The check only GETs `/` and reads the build header. It does not post XML and it does not confirm RCE.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the site root. It does not authenticate or change farm state.

### Does the check need credentials?

No. It fingerprints the public root response the way an external scanner would.

### What is CVE-2019-0604?

Unsafe XML deserialization in Microsoft SharePoint Server that can lead to remote code execution. This workflow maps hosts to that CVE by unauthenticated build exposure only.

## Related workflows

- [SharePoint code-injection RCE (CVE-2023-24955)](/library/cve-2023-24955-sharepoint-code-injection-rce). Reach for it when you need the later SharePoint code-injection fingerprint.
- [Jira SSTI (CVE-2019-11581)](/library/cve-2019-11581-jira-ssti). Reach for it when the next enterprise app check is Jira template injection exposure.

---
_Markdown source of https://trickest.com/library/cve-2019-0604-sharepoint-xml-deserialization-rce._