CVE-2023-24950

What it actually does

CVE-2023-24950 is a Microsoft SharePoint Server vulnerability that can allow an authenticated, low-privileged network attacker to spoof SharePoint-related identity or request context in a way that exposes sensitive information. The CVSS vector indicates network exploitability, low attack complexity, no user interaction, and high confidentiality impact, with no direct integrity or availability impact. Exploitation requires valid credentials or an authenticated session, so the primary risk is unauthorized disclosure after account compromise or misuse of a low-privileged account.

Why it matters to the business

A successful attack can expose sensitive documents, metadata, configuration details, or other SharePoint-hosted information to a user who should not have access. For organizations using SharePoint for internal collaboration, records management, intranet publishing, legal documents, financial data, or regulated information, this can lead to data leakage, compliance exposure, investigation costs, and loss of trust. The vulnerability is older but has a high EPSS score, meaning exploitation likelihood is materially elevated compared with many vulnerabilities, even though it is not currently listed in CISA KEV and is not known here to be ransomware-associated.

How an attack unfolds

An attacker first obtains valid SharePoint credentials, either through phishing, password reuse, credential theft, or access to a low-privileged account. The attacker then sends crafted authenticated requests to the SharePoint Server over the network. By abusing the spoofing weakness, the attacker can cause SharePoint to treat the request context in a way that discloses information outside the attacker’s intended authorization boundary. The attacker reviews the returned SharePoint responses, downloads or enumerates exposed content, and may use the information to support further compromise, privilege escalation, lateral movement, or targeted social engineering.

How to fix it

Apply the applicable Microsoft SharePoint Server security updates released by Microsoft for CVE-2023-24950, including the relevant May 2023 or later cumulative/security updates for the affected SharePoint Server product branch. Because no fixed version list was provided, administrators should confirm the exact patch level against Microsoft’s official Security Update Guide for the deployed SharePoint edition and build. After patching, ensure the SharePoint Products Configuration Wizard or equivalent post-update configuration steps have completed successfully on every SharePoint server in the farm. If immediate patching is not possible, reduce exposure by restricting SharePoint access to trusted networks or VPN, enforcing MFA for all SharePoint users, reviewing low-privileged account access, disabling stale accounts, and monitoring authenticated access to sensitive sites and document libraries.

How to confirm the fix worked

Confirm that every server in each SharePoint farm has the applicable Microsoft security update installed and that SharePoint build numbers match or exceed the Microsoft-documented fixed builds for CVE-2023-24950. Validate that post-patch SharePoint configuration tasks completed without error on all farm members. Perform authenticated testing with a low-privileged account to confirm it cannot access restricted sites, libraries, documents, metadata, or administrative pages. Review patch management records, installed update inventory, SharePoint build inventory, and farm health status to ensure there are no unpatched web front ends, application servers, or disaster recovery nodes.

Typical attack path

1. Obtain valid credentials for a low-privileged SharePoint user account.
2. Identify an internet-facing or internally reachable Microsoft SharePoint Server.
3. Authenticate to SharePoint and enumerate accessible sites, lists, libraries, and endpoints.
4. Send crafted SharePoint requests that abuse the spoofing flaw.
5. Collect sensitive information returned by the server that the account should not normally access.
6. Use the exposed information for data theft, additional credential targeting, lateral movement, or follow-on attacks.

How to detect it

To determine whether exploitation may already have occurred, review SharePoint ULS logs, IIS web access logs, authentication logs, reverse proxy/WAF logs, Microsoft 365 or identity-provider sign-in logs where applicable, and endpoint telemetry from SharePoint servers. Focus on authenticated users with low privileges accessing unusual site collections, document libraries, administrative paths, or high-value content. Look for spikes in HTTP 200 responses following repeated 401/403 responses, large or unusual downloads, access to many sites in a short time, activity from unfamiliar IP addresses or geographies, abnormal user-agent strings, and access occurring outside normal business hours. Correlate SharePoint access with identity events such as impossible travel, new device sign-ins, MFA failures, password resets, or recently compromised accounts. Because no reliable public exploit-specific request pattern is provided in the input, detection should emphasize behavioral anomalies and unauthorized information access rather than a single signature.

What your security team should do

• Prioritize patching SharePoint Server farms because the vulnerability is network-reachable, has low attack complexity, and has a high EPSS exploitation-likelihood score.
• Inventory all Microsoft SharePoint Server instances, including internal, internet-facing, development, staging, and disaster recovery farms.
• Apply the applicable Microsoft SharePoint security updates and complete required post-update configuration steps on every farm member.
• Temporarily restrict SharePoint access to trusted networks or VPN where patching is delayed.
• Enforce MFA and conditional access for SharePoint users, especially accounts with access to sensitive sites or libraries.
• Review SharePoint permissions for overexposed sites, broad groups, anonymous sharing, stale users, and excessive low-privileged access.
• Search SharePoint, IIS, ULS, authentication, and proxy logs for unusual authenticated enumeration or access to sensitive content by low-privileged accounts.
• Investigate any anomalous document downloads, permission-denied spikes followed by successful access, or access patterns inconsistent with user role and geography.