PT-2023-3210 · Microsoft · Sharepoint Server

Jang + 1 · Published 2023-06-13 · Updated 2026-05-01 · CVE-2023-29357

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server versions prior to 16.0.10399.20005

Description This issue is an elevation of privilege vulnerability in Microsoft SharePoint Server that allows attackers to affect the system. The vulnerability enables remote attackers to gain administrator privileges by circumventing authentication using spoofed JWT auth tokens. This flaw is actively exploited and has been observed in attacks, with reports of successful exploitation attempts. The vulnerability has been exploited in conjunction with other flaws to enable remote code execution. Approximately 2500 internet-connected SharePoint servers globally are estimated to be vulnerable, with around 650 located in Russia. The vulnerability is tracked as CVE-2023-29357. Exploitation involves targeting the /api/web/siteusers endpoint.

Recommendations Update Microsoft SharePoint Server to version 16.0.10399.20005 or later.

Exploit

Fix

LPE

RCE

DoS

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

CWE-303

CWE-264

Related Identifiers

BDU:2023-03330

CVE-2023-29357

ZDI-23-882

Affected Products

Sharepoint Server

References · 176

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-29357 · Exploit
• 🔥 https://github.com/LuemmelSec/CVE-2023-29357 · Exploit
• 🔥 https://github.com/Guillaume-Risch/cve-2023-29357-Sharepoint · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29357 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/699320 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29357 · Security Note
• https://bdu.fstec.ru/vul/2023-03330 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-882 · Security Note
• https://twitter.com/reverseame/status/1722703869883347140 · Twitter Post
• https://twitter.com/jbhall56/status/1708157563320041537 · Twitter Post
• https://0xsultan.github.io/dfir/Xintra-Crash-Dump-Analysis · Note
• https://twitter.com/InfoSec_Bret/status/1870605170817548326 · Twitter Post