Microsoft SharePoint SPXmlDataSource ASPX DataFile Fetch Inbound (CVE-2024-30043)

Tim Peck@timpeck

•updated Nov 11, 2025•0•23

This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource that allows for XML External Entity (XXE) injection. The rule specifically looks for HTTP responses containing SharePoint XML data source declarations and a 'DataFile' attribute with a path that starts with 'file://', 'smb://', or '\\', indicating an attempt to fetch local or network files.