Understanding Exploited SharePoint — What to Patch Now

Unpacking Actively Exploited SharePoint

Microsoft SharePoint Server deployments face significant risks from actively exploited vulnerabilities. Two critical flaws, CVE-2023-29357 and CVE-2023-24955, allow attackers to gain administrator privileges and execute arbitrary code. Threat actors often chain these vulnerabilities to achieve unauthenticated remote code execution (RCE) on vulnerable servers. This poses a direct threat to enterprise collaboration infrastructure and sensitive business data.

Vulnerability and Impact: CVE-2023-29357

CVE-2023-29357 is an Elevation of Privilege (EoP) vulnerability in Microsoft SharePoint Server. It carries a CVSSv3 score of 9.8, rating it as critical. This flaw allows an unauthenticated, remote attacker to bypass authentication. The attacker sends a specially crafted JSON Web Token (JWT) authentication token to a vulnerable server. This grants them the privileges of an authenticated user, potentially an administrator, without user interaction. This vulnerability affects Microsoft SharePoint Server 2019 and SharePoint Server Subscription Edition.

Vulnerability and Impact: CVE-2023-24955

CVE-2023-24955 is a Remote Code Execution (RCE) vulnerability affecting Microsoft SharePoint Server. It has a CVSSv3 score of 7.2, classified as high severity. An authenticated attacker with Site Owner privileges can exploit this vulnerability. Successful exploitation allows them to execute arbitrary code on the affected SharePoint Server. This RCE vulnerability impacts Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition.

Technical Root Cause Analysis: CVE-2023-29357

The root cause of CVE-2023-29357 lies in improper authentication handling within Microsoft SharePoint Server. Specifically, SharePoint fails to correctly validate JSON Web Tokens (JWTs) during OAuth authentication. The vulnerability stems from a logic flaw in the ReadTokenCore() method. If the signing algorithm of a user-provided JWT is set to "none," SharePoint skips the signature validation step. This allows an attacker to forge a JWT token and impersonate any valid SharePoint user, including administrators.

Technical Root Cause Analysis: CVE-2023-24955

CVE-2023-24955 is a code injection flaw (CWE-94: Improper Control of Generation of Code). The vulnerability exists due to insufficient validation and sanitization of user-controlled input within SharePoint's processing logic. An authenticated attacker with Site Owner permissions can inject malicious code. The server then executes this code within the context of the SharePoint application pool identity, which typically runs as w3wp.exe.

Exploitation Mechanics

Attackers commonly chain CVE-2023-29357 and CVE-2023-24955 for unauthenticated RCE. The exploit begins with CVE-2023-29357. An attacker crafts a spoofed JWT token. This token bypasses SharePoint's authentication mechanism. The attacker can then impersonate an administrator.

After gaining administrative privileges via CVE-2023-29357, the attacker leverages CVE-2023-24955. They send a malicious request containing injected code. This code targets a SharePoint component susceptible to code injection. A common method involves replacing or uploading a malicious file, such as /BusinessDataMetadataCatalog/BDCMetadata.bdcm, in the web root directory. The SharePoint server processes this request without adequate validation, executing the injected code. This grants the attacker remote code execution capabilities on the server.

The attack vector for CVE-2023-29357 is network-based and requires no prior authentication or user interaction. The attacker sends malicious requests with spoofed JWT tokens directly to the vulnerable SharePoint Server. For CVE-2023-24955, the attack is also network-based. It requires authenticated access with Site Owner privileges, which the prior EoP vulnerability provides.

Detection: How to Check if You're Affected

Detecting successful exploitation or attempts requires comprehensive logging and monitoring. Review SharePoint Unified Logging Service (ULS) logs for authentication anomalies. Look for successful authentications with unusual JWT token characteristics. Monitor IIS logs for suspicious requests to SharePoint API endpoints, especially those returning HTTP 200 responses for unauthenticated requests.

Examine Windows Security Event Logs for privilege escalation events (Event IDs 4672, 4648). Deploy Endpoint Detection and Response (EDR) solutions on SharePoint servers. These tools identify suspicious process chains and anomalous PowerShell or command shell activity. Look for unexpected process execution originating from SharePoint application pool processes (w3wp.exe).

Network traffic analysis can reveal anomalous requests targeting SharePoint servers. Monitor for unusual file creation or modification within SharePoint web directories. For external facing SharePoint instances, use a free website vulnerability scanner to identify exposed services. A CMS vulnerability scanner can also help identify known vulnerabilities in SharePoint itself. Utilize tools like Zondex for internet-wide scanning to discover exposed SharePoint instances in your attack surface.

Configure alerts for process creation events from IIS application pools. Implement file integrity monitoring (FIM) for critical SharePoint directories. This helps detect unauthorized changes to web configuration files or the upload of malicious payloads. Audit Site Owner account activity for unusual or unauthorized actions.

Remediation Steps

Immediately apply the security updates released by Microsoft. For CVE-2023-29357, Microsoft released patches on June 13, 2023, as part of their Patch Tuesday. Affected versions of SharePoint Server 2019 require updates to build 16.0.10399.20005 or higher.

For CVE-2023-24955, Microsoft released patches on May 9, 2023. Apply these updates to SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Consult the Microsoft Security Update Guide for detailed patching instructions specific to your SharePoint Server version.

Implement network segmentation to limit exposure of SharePoint servers. Restrict network access using firewall rules, allowing only necessary traffic. Enforce the principle of least privilege for all SharePoint users and service accounts. Review and audit Site Owner permissions across all site collections. Consider implementing Web Application Firewall (WAF) rules to inspect and validate JWT tokens before they reach SharePoint servers.

Timeline of Disclosure

CVE-2023-24955 was publicly disclosed and patched by Microsoft on May 9, 2023, during their monthly Patch Tuesday release. This vulnerability was actively exploited in the wild prior to its disclosure. CISA added CVE-2023-24955 to its Known Exploited Vulnerabilities (KEV) catalog on March 26, 2024, confirming its active exploitation and use in ransomware campaigns.

CVE-2023-29357 was publicly disclosed and patched on June 13, 2023, as part of Microsoft's June Patch Tuesday. Researchers demonstrated an exploit chain combining CVE-2023-29357 and CVE-2023-24955 at the Zero Day Initiative's Pwn2Own contest in March 2023. A proof-of-concept for the exploit chain became publicly available on September 26, 2023. CISA added CVE-2023-29357 to its KEV catalog on January 1, 2024.