CVE-2024-30043: Abusing URL Parsing Confusion to Exploit XXE on SharePoint Server and Cloud

This analysis demonstrates an XXE vulnerability in SharePoint where malformed URLs (for example using a file://localhost\\c$/... form) can cause SPXmlDataSource/XmlSecureResolver to create an unrestricted policy, allowing local file access and remote exfiltration; the author documents experimentation with URL parsing and a practical bypass of SharePoint protections.