Stopping SharePoint’s CVE-2019-0604

This post details Cloudflare's rapid response to CVE-2019-0604, a critical RCE vulnerability in Microsoft SharePoint. It describes the discovery of the vulnerability's unauthenticated exploit path, the analysis of early reconnaissance probes and exploit attempts, and the decision to deploy a WAF rule (100157) in default block mode on May 13th, before a stable patch was widely available or exploits were fully weaponized. The post also provides technical details on the vulnerability's root cause, including the `DecodeEntityInstanceId` function and the XML deserialization payload, and analyzes the traffic patterns observed after the rule deployment.