Microsoft SharePoint SPXmlDataSource ASPX DataFile Fetch Inbound (CVE-2024-30043)

Tim Peck@timpeck

•updated Nov 10, 2025•0•18

This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource. The detection is based on the presence of specific content in HTTP response bodies, including '<!DOCTYPE', '<SharePoint:SPXmlDataSource', and 'DataFile="', combined with a PCRE regex matching file or SMB paths, indicating an attempt to fetch data via XML External Entity (XXE) injection.