PT-2023-2720 · Microsoft · Sharepoint Server

Jang + 1 · Published 2023-05-09 · Updated 2025-08-04 · CVE-2023-24955

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified)

Description The issue is related to a remote code execution vulnerability in Microsoft SharePoint Server. This vulnerability allows an authenticated attacker with Site Owner privileges to execute arbitrary code. The vulnerability is being actively exploited in the wild. According to some sources, over 43,658 targets related to this vulnerability were discovered using ZoomEye. The vulnerability can be exploited together with another issue to bypass authentication and use the SharePoint API with administrator privileges. A public exploit is available that uses both vulnerabilities.

Recommendations As a temporary workaround, consider disabling the vulnerable functionality until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Apply the patch released by Microsoft in May 2023 to the latest secure version. Federal agencies must apply fixes by April 16, 2024. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it is recommended to update to the latest secure version.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

BDU:2023-02565

CVE-2023-24955

ZDI-23-883

Affected Products

Sharepoint Server

References · 115

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-29357 · Exploit
• 🔥 https://github.com/former-farmer/CVE-2023-24955-PoC · Exploit
• 🔥❌ https://github.com/AndreOve/CVE-2023-24955-real-RCE · Exploit, Deleted
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02565 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24955 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-24955 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24955 · Security Note
• https://twitter.com/TheSharkStriker/status/1773585669819945015 · Twitter Post
• https://twitter.com/DonMalloy/status/1773311977039011871 · Twitter Post
• https://twitter.com/Hadess_security/status/1709136514192457812 · Twitter Post
• https://twitter.com/BlackpointUS/status/1773073102395564376 · Twitter Post
• https://t.me/true_secator/4360 · Telegram Post