CVE-2023-29357

What it actually does

CVE-2023-29357 is a network-reachable authentication bypass and elevation-of-privilege flaw in Microsoft SharePoint Server. A remote unauthenticated attacker can present a crafted authentication token that SharePoint accepts as valid, allowing the attacker to impersonate a privileged SharePoint user and perform actions with administrative permissions. Successful exploitation can expose SharePoint content, allow modification of sites and permissions, and can be chained with other SharePoint vulnerabilities to achieve remote code execution on the server.

Why it matters to the business

A compromised SharePoint server can lead to theft or alteration of business documents, exposure of sensitive internal data, disruption of collaboration services, and potentially full compromise of the underlying Windows server if chained with follow-on exploits. The vulnerability has a critical CVSS score, extremely high EPSS probability, is listed in CISA KEV, has been exploited in the wild, and is associated with ransomware activity, so unpatched internet-accessible SharePoint deployments should be treated as high-priority incident-risk assets.

How an attack unfolds

An attacker first identifies an exposed Microsoft SharePoint Server instance and confirms it is running a vulnerable build. The attacker then sends crafted HTTP requests containing a forged authentication token to SharePoint endpoints that rely on server-side token validation. If the server is vulnerable, SharePoint accepts the forged token and treats the attacker as an authenticated privileged user. From there, the attacker can enumerate site metadata, read or modify content, change users or permissions, and attempt to establish persistence through administrative changes. In many real-world scenarios, this privilege escalation is used as the first stage in a chain with another SharePoint vulnerability to upload malicious components, execute commands, deploy web shells, move laterally, or support ransomware operations.

How to fix it

Apply the Microsoft security updates that address CVE-2023-29357 to every SharePoint Server in the farm, including all web front ends, application servers, and any standby or disaster-recovery servers. Because no exact fixed versions were provided in the input, use the applicable Microsoft June 2023 security update or any later cumulative/security update for the installed SharePoint Server release, and then run the required SharePoint Products Configuration Wizard or equivalent configuration step on every server. If immediate patching is not possible, restrict SharePoint access to trusted networks or VPN, block direct internet exposure, enforce web application firewall rules for suspicious bearer-token abuse against SharePoint REST endpoints, and increase monitoring; however, network restrictions are temporary mitigations and do not replace patching. Review SharePoint farm health after patching and verify all servers report the same supported build level.

How to confirm the fix worked

Confirm that every SharePoint server in the farm has the Microsoft update level that includes the June 2023 or later fix for this vulnerability. Validate from Central Administration, PowerShell build checks, installed update inventory, and vulnerability scanner results. Ensure the SharePoint configuration wizard has completed successfully on each server after patch installation. Retest exposure by confirming unauthenticated requests cannot access privileged SharePoint REST, administrative, or user-management endpoints using bearer/JWT-style authentication material. Also verify that internet-facing SharePoint endpoints are minimized and that IIS, SharePoint ULS, and security audit logging are enabled and retained long enough for investigation.

Typical attack path

1. Scan the internet or internal address space for exposed Microsoft SharePoint Server instances.
2. Fingerprint SharePoint version/build information or test behavior against known vulnerable endpoints.
3. Send crafted requests with a forged bearer/JWT-style authentication token to SharePoint REST or administrative endpoints.
4. Impersonate a privileged SharePoint identity if token validation is bypassed.
5. Enumerate sites, users, permissions, documents, and configuration through SharePoint APIs.
6. Create or modify privileged users, permissions, pages, workflows, or application artifacts where possible.
7. Optionally chain the gained privileges with a separate SharePoint remote-code-execution vulnerability to run commands or deploy malware.
8. Exfiltrate data, establish persistence, or stage ransomware activity.

How to detect it

To determine whether exploitation already occurred, review IIS W3C logs for requests to SharePoint REST and administrative paths from unauthenticated, unusual, or external sources, especially requests containing bearer-token authentication followed by successful 200/201/204 responses. Correlate these with SharePoint ULS logs for unusual authentication, OAuth, JWT, or user-impersonation events and with SharePoint audit logs for new site collection administrators, permission changes, app principal changes, document access spikes, or unexpected page/workflow modifications. Examine Windows Security logs for new local or domain account activity, privilege changes, suspicious logons to SharePoint servers, and service creation. Use EDR telemetry to identify abnormal child processes from IIS or SharePoint worker processes, including PowerShell, cmd.exe, certutil, bitsadmin, msiexec, rundll32, wscript, cscript, or encoded command execution. Because this vulnerability is commonly valuable as part of an exploit chain, search for web shells under SharePoint virtual directories and the SharePoint hive, newly written ASPX files, unexpected DLLs, archive tools, credential dumping tools, and outbound connections from SharePoint servers to unfamiliar hosts. Pay particular attention to activity occurring after June 2023 and before verified patch completion.

• /_api/web/currentuser
• /_api/web/siteusers
• /_api/web/sitegroups
• /_api/contextinfo
• /_layouts/15/Authenticate.aspx
• Authorization: Bearer eyJ
• X-Forms_Based_Auth_Accepted: f
• python-requests
• powershell.exe -enc
• powershell.exe -EncodedCommand
• w3wp.exe -> powershell.exe
• w3wp.exe -> cmd.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> msiexec.exe
• w3wp.exe -> rundll32.exe
• C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• C:\inetpub\wwwroot\wss\VirtualDirectories\*.aspx
• /_layouts/15/*.aspx

What your security team should do

• Immediately patch all affected Microsoft SharePoint Server systems; this vulnerability is in CISA KEV, has a CISA remediation deadline of 2024-01-31, has very high EPSS, and is known to be exploited in the wild including ransomware-related activity.
• Prioritize externally reachable SharePoint servers, high-value collaboration farms, and servers with access to sensitive document repositories.
• If patching cannot be completed immediately, remove direct internet exposure and require access through trusted network paths while emergency patching is scheduled.
• Hunt for prior exploitation across IIS logs, SharePoint ULS logs, SharePoint audit logs, Windows Security logs, EDR telemetry, and web server artifacts.
• Review SharePoint administrators, site collection administrators, app principals, OAuth trust settings, recently changed permissions, newly uploaded files, and unexpected workflow/page changes.
• Look for exploit chaining activity, especially suspicious file uploads, web shell creation, PowerShell execution, child processes spawned from SharePoint/IIS worker processes, and outbound connections from SharePoint servers.
• Reset credentials and secrets associated with suspicious SharePoint administrator accounts or app principals if compromise is suspected.
• Maintain long-term monitoring rules for forged-token attempts and anomalous SharePoint REST API access patterns.