CVE-2023-21742

What it actually does

CVE-2023-21742 is a network-reachable remote code execution vulnerability in Microsoft SharePoint Foundation and Microsoft SharePoint Server. An attacker with low-privileged authenticated access can send crafted requests to a vulnerable SharePoint server and trigger server-side code execution. Successful exploitation can allow execution of attacker-controlled code in the context of the SharePoint web application or associated service account, potentially exposing SharePoint content, configuration secrets, authentication material, and connected resources.

Why it matters to the business

A compromised SharePoint server can give an attacker access to sensitive documents, collaboration data, internal workflows, and credentials used by the platform. Because SharePoint often sits at the center of enterprise document management and integrates with directory services, email, Office applications, and business processes, exploitation can lead to data theft, operational disruption, lateral movement, and loss of trust in shared content. Although this vulnerability is not currently listed in CISA KEV and has no confirmed ransomware association in the provided data, its CVSS score is high and its EPSS probability is elevated, so unpatched internet-facing or broadly accessible SharePoint deployments should be treated as priority remediation targets.

How an attack unfolds

An attacker first obtains or compromises a valid low-privileged SharePoint account, since the vulnerability requires authentication. The attacker then identifies a vulnerable SharePoint Foundation or SharePoint Server instance and sends crafted HTTP requests to the affected SharePoint endpoint. If the server is unpatched, SharePoint processes the malicious input in a way that results in server-side code execution. The attacker may then run commands under the SharePoint application pool or service context, write web-accessible files, deploy persistence, enumerate SharePoint content databases through application access, dump configuration secrets, and use the compromised server as a foothold for broader internal reconnaissance or lateral movement.

How to fix it

Apply the Microsoft security update that addresses CVE-2023-21742 for all affected Microsoft SharePoint Foundation and Microsoft SharePoint Server installations. Because exact fixed build numbers were not provided in the input, use Microsoft’s official Security Update Guide and SharePoint build/version documentation to identify the correct cumulative or security update for each installed SharePoint version. Patch every SharePoint server in the farm, including web front ends, application servers, and any legacy or standby nodes. After patching, run the SharePoint Products Configuration Wizard or equivalent post-update configuration steps where required by Microsoft. If immediate patching is not possible, reduce exposure by restricting SharePoint access to trusted networks or VPN, enforcing MFA for SharePoint access, disabling unused externally reachable sites, reviewing low-privileged account access, and monitoring for abnormal authenticated requests and post-exploitation behavior. Mitigations should be considered temporary and should not replace applying the vendor update.

How to confirm the fix worked

Confirm that each SharePoint server is running a Microsoft build level that includes the security update for CVE-2023-21742. Validate both the installed binaries and the farm patch state, since SharePoint updates may require post-install configuration to fully apply. Use Microsoft SharePoint Central Administration, PowerShell build checks, Windows Update history, installed update inventory, and vulnerability scanner results to confirm remediation across all farm members. Re-scan externally reachable SharePoint URLs and internal SharePoint servers with an authenticated vulnerability scanner. Review whether any vulnerable servers remain due to incomplete cumulative update installation, failed configuration wizard execution, load-balanced nodes missed during patching, or unsupported SharePoint versions.

Typical attack path

1. Obtain valid low-privileged SharePoint credentials through phishing, credential stuffing, password reuse, or prior compromise.
2. Identify a reachable Microsoft SharePoint Foundation or SharePoint Server deployment that has not received the relevant security update.
3. Authenticate to SharePoint and send crafted requests that trigger the vulnerable code path.
4. Achieve code execution in the context of the SharePoint web application or associated service account.
5. Execute reconnaissance commands, enumerate local configuration, and inspect SharePoint application settings.
6. Access or export sensitive SharePoint documents, lists, and configuration data.
7. Attempt privilege escalation, credential theft, web shell placement, scheduled task creation, or lateral movement to connected systems.

How to detect it

To determine whether exploitation already occurred, review IIS logs for unusual authenticated requests to SharePoint endpoints, especially requests followed by server errors, unexpected file writes, or process execution. Examine SharePoint ULS logs for abnormal exceptions, unexpected feature/page activity, unusual authenticated access patterns, and requests from unfamiliar IP addresses or user agents. Correlate with Windows Security logs for logon events, privilege use, service creation, scheduled task creation, and new process execution. EDR or Sysmon telemetry is especially important: look for IIS worker processes spawning command shells, PowerShell, script interpreters, archive tools, network utilities, or credential-dumping tools. Inspect SharePoint web roots and layouts directories for recently created ASPX files, renamed binaries, or web shell-like content. Review PowerShell operational logs for encoded commands, download cradles, SharePoint snap-in abuse, or post-exploitation reconnaissance. Because no specific public exploit indicator is provided, detection should focus on behavioral evidence of authenticated SharePoint exploitation and post-exploitation activity rather than a single fixed request string.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> curl.exe
• w3wp.exe -> wget.exe
• C:\inetpub\wwwroot\wss\VirtualDirectories\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\LOGS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• -enc
• -EncodedCommand
• Invoke-WebRequest
• IEX
• DownloadString
• New-Object Net.WebClient
• Add-PSSnapin Microsoft.SharePoint.PowerShell

What your security team should do

• Prioritize patching internet-facing and broadly accessible SharePoint servers because the vulnerability is remotely reachable, requires only low privileges, and has a high EPSS score.
• Inventory all Microsoft SharePoint Foundation and SharePoint Server instances, including legacy farms, development systems, disaster recovery nodes, and servers behind load balancers.
• Verify that all SharePoint farm members have received the relevant Microsoft security update and completed required post-update configuration steps.
• Restrict SharePoint administrative and user access to trusted networks where feasible and enforce MFA for all remote access paths.
• Hunt for signs of authenticated exploitation, including unusual SharePoint requests followed by command execution from IIS worker processes.
• Review SharePoint service account privileges and remove excessive local administrator, domain administrator, or broad database privileges where not required.
• Inspect SharePoint web directories, layouts directories, and temporary folders for newly created or modified ASPX files, web shells, scripts, or binaries.
• Correlate SharePoint, IIS, Windows Security, PowerShell, EDR, and proxy logs for suspicious activity around the time of anomalous authenticated SharePoint requests.
• If compromise is suspected, isolate the affected SharePoint server, preserve logs and forensic artifacts, rotate SharePoint service account credentials, and assess connected systems for lateral movement.