SRC-2021-0018 : Microsoft SharePoint Server OAuth Authorization Code Leak Elevation of Privilege Vulnerability

Vulnerability Details:

This vulnerability allows remote attackers to elevate privileges. User interaction is required required to exploit this vulnerability. The specific flaw exists in the oauthauthorize page. The issue results from a missing X-Frame-Options header when performing an authorization code grant. An attacker can leverage this vulnerability to bypass the consent page and disclose the authorization code of a privileged user to gain elevated access.

Affected Vendors:

Microsoft

Affected Products:

SharePoint Server

Vendor Response:

Microsoft has issued an update to correct this vulnerability. More details can be found at: <https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31172&gt;