CVE-2023-24955

What it actually does

CVE-2023-24955 is a remote code execution vulnerability in Microsoft SharePoint Server. A network-reachable attacker with high SharePoint privileges can trigger code injection on the server and execute arbitrary commands in the context of the SharePoint/IIS application pool or related service account. Successful exploitation can give the attacker control over the SharePoint web application, access to stored documents and configuration data, and a foothold for credential theft, web shell deployment, lateral movement, or ransomware staging.

Why it matters to the business

Compromise of SharePoint can expose sensitive documents, disrupt collaboration portals, damage business workflows, and provide attackers with a privileged foothold inside the Windows domain. This vulnerability is listed in CISA KEV, has known in-the-wild exploitation, is associated with ransomware activity, and has a high EPSS likelihood score, so internet-accessible or broadly reachable SharePoint servers should be treated as urgent remediation targets. The CISA KEV remediation due date was 2024-04-16, meaning regulated organizations should already have remediated it and should now focus on confirming patch status and looking for historical compromise.

How an attack unfolds

An attacker first identifies a vulnerable Microsoft SharePoint Server that is reachable over HTTP or HTTPS. Because the flaw requires high privileges, the attacker either authenticates with a highly privileged SharePoint account, uses stolen administrative credentials, abuses an already-compromised account, or chains this issue with another SharePoint authentication or privilege-escalation vulnerability. The attacker then sends crafted SharePoint requests that trigger the code injection condition and cause server-side command execution. After code execution, common post-exploitation actions include spawning PowerShell or cmd.exe from the IIS worker process, writing an ASPX web shell into a SharePoint-accessible directory, dumping configuration and credential material, accessing document libraries, moving laterally to domain resources, and deploying ransomware or additional persistence.

How to fix it

Apply the Microsoft security updates that address CVE-2023-24955 to every affected Microsoft SharePoint Server in the farm, including SharePoint Enterprise Server and SharePoint Server editions. If exact fixed build numbers are not tracked internally, install the May 2023 SharePoint security update or any later cumulative/security update applicable to the deployed SharePoint version. Patch all SharePoint farm members consistently, then run the SharePoint Products Configuration Wizard or equivalent post-update configuration step on every server to complete the update. Restrict direct internet access to SharePoint where possible, require VPN or strong conditional access for administrative functions, reduce the number of Site Collection Administrators and farm administrators, enforce MFA for privileged accounts, and audit stale or excessive SharePoint permissions. If exploitation is suspected, do not rely on patching alone: isolate affected servers, preserve forensic evidence, remove web shells, rotate SharePoint service account credentials and related secrets, and consider rebuilding compromised servers from known-good media.

How to confirm the fix worked

Confirm that every SharePoint server in each farm has the relevant Microsoft security update or a later cumulative/security update installed. Validate patch status through SharePoint Central Administration patch status, installed update inventory, build-number checks, and farm-wide consistency checks such as Get-SPProduct -Local or equivalent administrative tooling. Confirm that the SharePoint Products Configuration Wizard completed successfully after patching. Run an authenticated vulnerability scan or configuration assessment against SharePoint servers to verify the vulnerability is no longer reported. Review IIS bindings, firewall rules, and reverse proxy/WAF configuration to confirm that only intended networks can reach SharePoint. Finally, validate that high-privilege SharePoint accounts are still required, protected with MFA where applicable, and not shared or stale.

Typical attack path

1. Discover an exposed or internally reachable Microsoft SharePoint Server instance.
2. Obtain or create high-privilege SharePoint access, often by credential theft or chaining with another SharePoint vulnerability.
3. Send crafted authenticated SharePoint requests that trigger the code injection flaw.
4. Execute operating system commands under the SharePoint/IIS worker process or service account context.
5. Deploy a web shell, scripted loader, or remote access tool for persistence.
6. Enumerate SharePoint configuration, document libraries, service accounts, and reachable domain resources.
7. Steal data, move laterally, disable defenses, or stage ransomware deployment.

How to detect it

Hunt for signs that SharePoint or IIS executed unexpected commands or wrote suspicious files. Review IIS W3C logs for unusual authenticated POST requests to SharePoint application paths, especially /_layouts/15/ and administrative endpoints, from unfamiliar IP addresses or accounts. Review SharePoint ULS logs for errors, unexpected administrative actions, solution/package deployment activity, and anomalous requests around the same timestamps. Review Windows Security logs for privileged logons, new service creation, process creation if enabled, and suspicious activity by SharePoint service accounts. Review PowerShell logs for encoded commands, download cradles, credential access, or script blocks launched near SharePoint worker-process activity. In EDR/Sysmon, alert on w3wp.exe spawning cmd.exe, powershell.exe, rundll32.exe, mshta.exe, certutil.exe, bitsadmin.exe, cscript.exe, wscript.exe, or other living-off-the-land tools. Search SharePoint web directories and the SharePoint hive for recently created or modified ASPX files, especially files containing command execution, Base64 decoding, or request-evaluation logic. Also look for outbound connections from SharePoint servers to unfamiliar external infrastructure, archive creation of document repositories, mass file access, antivirus exclusions, disabled services, and ransomware pre-staging behavior.

• w3wp.exe
• w3wp.exe powershell.exe
• w3wp.exe cmd.exe
• w3wp.exe certutil.exe
• w3wp.exe bitsadmin.exe
• w3wp.exe mshta.exe
• w3wp.exe rundll32.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c
• certutil.exe -urlcache
• bitsadmin /transfer
• /_layouts/15/
• /_layouts/16/
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\CONTROLTEMPLATES\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\
• C:\inetpub\wwwroot\wss\VirtualDirectories\
• System.Diagnostics.Process
• ProcessStartInfo
• FromBase64String
• eval(Request
• Request.Form
• Request.QueryString
• .aspx

What your security team should do

• Immediately verify patch status for all Microsoft SharePoint Server and SharePoint Enterprise Server instances, prioritizing internet-facing systems and farms that host sensitive business documents.
• Because this is a KEV-listed vulnerability associated with ransomware and active exploitation, perform retrospective threat hunting even if systems are now patched.
• Review IIS, SharePoint ULS, Windows Security, PowerShell, Sysmon/EDR, and file-system telemetry for suspicious activity by w3wp.exe and unexpected ASPX file creation.
• Audit privileged SharePoint roles, especially farm administrators, Site Collection Administrators, and service accounts, and remove unnecessary privileges.
• Block direct administrative access to SharePoint from untrusted networks and place internet-facing SharePoint behind strong authentication, reverse proxy controls, and monitoring.
• If suspicious command execution, web shells, or credential theft artifacts are found, initiate incident response, rotate credentials, and assess lateral movement and ransomware staging.