PT-2023-3210 · Microsoft · Sharepoint Server

Jang + 1 · Publicado 2023-06-13 · Atualizado 2026-05-01 · CVE-2023-29357

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server versions prior to 16.0.10399.20005

Description This issue is an elevation of privilege vulnerability in Microsoft SharePoint Server that allows attackers to affect the system. The vulnerability enables remote attackers to gain administrator privileges by circumventing authentication using spoofed JWT auth tokens. This flaw is actively exploited and has been observed in attacks, with reports of successful exploitation attempts. The vulnerability has been exploited in conjunction with other flaws to enable remote code execution. Approximately 2500 internet-connected SharePoint servers globally are estimated to be vulnerable, with around 650 located in Russia. The vulnerability is tracked as CVE-2023-29357. Exploitation involves targeting the /api/web/siteusers endpoint.

Recommendations Update Microsoft SharePoint Server to version 16.0.10399.20005 or later.

Exploit

Correção

LPE

RCE

DoS

UI Misrepresentation of Critical Information

Enumeração de Fraquezas

CWE-451

CWE-303

CWE-264

Identificadores relacionados

BDU:2023-03330

CVE-2023-29357

ZDI-23-882

Produtos afetados

Sharepoint Server

Referências · 176

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-29357 · Exploit
• 🔥 https://github.com/LuemmelSec/CVE-2023-29357 · Exploit
• 🔥 https://github.com/Guillaume-Risch/cve-2023-29357-Sharepoint · Exploit
• https://twitter.com/reverseame/status/1722703869883347140 · Publicação no Twitter
• https://twitter.com/jbhall56/status/1708157563320041537 · Publicação no Twitter
• https://0xsultan.github.io/dfir/Xintra-Crash-Dump-Analysis · Nota
• https://twitter.com/InfoSec_Bret/status/1870605170817548326 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1952251588338184232 · Publicação no Twitter
• https://t.me/ckure/13748 · Publicação no Telegram
• https://twitter.com/CyberElNiak/status/1757517966323679714 · Publicação no Twitter
• https://t.me/malwr/7526 · Publicação no Telegram
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://twitter.com/TiltCyber/status/1707281456429408654 · Publicação no Twitter
• https://twitter.com/inversecos/status/1825833704306126924 · Publicação no Twitter