Skip to content
COOEY

EXPOSURES › CVE-2023-29357

CVE-2023-29357

CRITICAL ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2024-01-10 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-29357 ↗
⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 85/100 ransomwareexploited-in-wildunpatchedprivilege-escalationauth-bypassrce

An unauthenticated attacker could spoof JWT tokens to escalate to SharePoint admin privileges and execute network attacks.

CVE-2023-29357 allows attackers to bypass SharePoint authentication via spoofed JWT tokens, gaining administrator access and executing network attacks. DIBs must patch SharePoint immediately and monitor for JWT token spoofing attempts, as this flaw was actively exploited in the wild and linked to ransomware campaigns.

Shame score — A critical privilege escalation flaw in a widely deployed enterprise product was actively exploited in the wild and linked to ransomware, demonstrating severe negligence in patching and threat intelligence.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

DESCRIPTION

Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.

AFFECTED FEDRAMP PRODUCTS · 4
PRODUCTSTATUS
Azure Commercial Cloud
Microsoft
Authorized
Azure Government (includes Dynamics 365)
Microsoft
Authorized
Microsoft Office 365 GCC High
Microsoft
In Process
Office 365 Multi-Tenant & Supporting Services
Microsoft
Authorized