CVE-2023-24955
Microsoft SharePoint Server Code Injection Vulnerability
Description
CVE-2023-24955 is a high-severity remote code execution vulnerability in Microsoft SharePoint Server that allows an authenticated attacker with Site Owner privileges to execute arbitrary code on the server. With a CVSS v3.1 base score of 7.2, this flaw enables privileged users to compromise the SharePoint server through network-based attacks without requiring user interaction. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 16, 2024, and it has a known ransomware association. The EPSS score of 91.76% at the 99.7th percentile confirms massive real-world exploitation activity. Affected products include Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint enterprise server | 2016 |
| microsoft | sharepoint server | -; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24955(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2023-24955 by NVD. Based on the vulnerability characteristics, this is a remote code execution vulnerability that allows authenticated users with Site Owner privileges to execute arbitrary code on the SharePoint server. The flaw likely involves improper input validation or insecure deserialization within SharePoint's server-side processing logic, where Site Owner-level operations can be manipulated to achieve code execution in the context of the SharePoint application pool. SharePoint's complex architecture, with its extensive server-side processing of user-supplied content including web parts, workflows, and site templates, provides multiple surfaces where insufficient validation of privileged user input can lead to code execution.
Impact Analysis
The impact of CVE-2023-24955 is severe across all dimensions of the CIA triad, amplified by SharePoint's central role in enterprise collaboration and document management. Confidentiality is fully compromised because SharePoint servers store vast quantities of corporate data including internal documents, financial records, intellectual property, human resources data, project plans, and strategic communications. Code execution on the SharePoint server grants access to the entire content database, including documents across all site collections that the application pool identity can access, as well as configuration data containing connection strings and service account credentials.
Integrity faces maximum impact as the attacker can modify any SharePoint content, plant backdoor web parts or workflows that execute on future page loads, alter document contents without visible modification timestamps, and deploy persistent server-side code. The ability to modify documents and site content on a platform trusted by the entire organization creates severe supply chain attack possibilities where modified documents are distributed to employees and partners.
Availability is critically threatened because the attacker can disrupt SharePoint services affecting all users across the organization, encrypt content databases for ransomware, or corrupt the SharePoint farm configuration. The known ransomware association confirms that ransomware operators are actively exploiting this vulnerability. The EPSS score of 91.76% at the 99.7th percentile places this among the top 0.3% of all tracked vulnerabilities in terms of exploitation probability. The authentication requirement (Site Owner privileges) does not significantly limit exploitation because many organizations grant Site Owner permissions broadly, and attackers frequently obtain these privileges through phishing or credential theft.
Exploit Maturity
CVE-2023-24955 demonstrates very high exploit maturity with confirmed active exploitation, known ransomware campaigns, and widespread targeting of SharePoint Server installations. The EPSS score of 91.76% at the 99.7th percentile indicates near-certain exploitation of vulnerable instances. CISA's KEV listing with an April 16, 2024 deadline and the known ransomware association confirm this is a critical threat.
The official Microsoft advisory at MSRC CVE-2023-24955 provides patch and mitigation details. This vulnerability is frequently chained with CVE-2023-29357, a SharePoint privilege escalation flaw that allows an unauthenticated attacker to gain Site Owner privileges. When combined, these two vulnerabilities create an unauthenticated remote code execution chain against SharePoint Server. The combination was demonstrated at Pwn2Own and has since been widely adopted by threat actors. The high privilege requirement of CVE-2023-24955 alone becomes irrelevant when paired with the authentication bypass, making the combined chain particularly dangerous for internet-facing SharePoint deployments.
Remediation
-
Apply the Microsoft security update immediately from the Microsoft Security Response Center. Patches are available for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Given the 91.76% EPSS score and known ransomware association, this patch should be treated as the highest priority for any SharePoint deployment.
-
Also patch CVE-2023-29357 (SharePoint privilege escalation) if not already remediated, as these two vulnerabilities are commonly chained to achieve unauthenticated remote code execution. The combined exploitation chain eliminates the Site Owner privilege requirement of CVE-2023-24955, making the combined impact significantly worse than either vulnerability alone.
-
Restrict network access to SharePoint Server by ensuring that internet-facing exposure is minimized. Place SharePoint behind a reverse proxy or web application firewall that can filter malicious requests. If SharePoint must be internet-accessible, ensure only the necessary endpoints are exposed and that authentication is enforced at the network perimeter.
-
Audit Site Owner permissions across all SharePoint site collections to ensure the principle of least privilege is enforced. Review and reduce the number of users with Site Owner or higher permissions. Implement monitoring for Site Owner privilege grants and remove unnecessary elevated permissions that increase the attack surface for this vulnerability.
-
Monitor SharePoint servers for indicators of compromise by reviewing application event logs, IIS logs, and SharePoint ULS logs for unusual activity. Watch for unexpected process creation from w3wp.exe (the SharePoint application pool worker process), unusual file system modifications in SharePoint directories, and anomalous outbound network connections from the SharePoint server.
Technical Details
CVE-2023-24955 is a remote code execution vulnerability in Microsoft SharePoint Server, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vector indicates a network-exploitable flaw that requires high privileges but is otherwise straightforward to exploit. Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means the exploit works reliably without special conditions. Privileges Required (PR:H) indicates Site Owner or equivalent administrative privileges are needed, which is the most significant barrier to exploitation in isolation. User Interaction (UI:N) confirms no victim action is required. Scope (S:U) remains unchanged within the SharePoint server context.
The vulnerability allows a user with Site Owner privileges to execute arbitrary code on the SharePoint server, typically in the context of the SharePoint application pool identity (often a domain service account with significant Active Directory privileges). SharePoint's architecture processes numerous types of user-supplied content server-side, including web parts, site templates, workflow definitions, and various XML-based configurations. The code execution mechanism likely exploits insufficient validation of one of these privileged content types, allowing the Site Owner to inject code that is subsequently executed by the SharePoint server process. The affected versions span SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, indicating a vulnerability in core SharePoint functionality shared across multiple product generations. When chained with CVE-2023-29357 (authentication bypass), the effective attack complexity drops to unauthenticated remote code execution.
Frequently Asked Questions
What is CVE-2023-24955?
CVE-2023-24955 is a remote code execution vulnerability in Microsoft SharePoint Server that allows an authenticated user with Site Owner privileges to execute arbitrary code on the server. With a CVSS score of 7.2 and a known ransomware association, it represents a critical threat to SharePoint deployments.
Why is this vulnerability associated with ransomware?
SharePoint servers contain large volumes of corporate documents and are deeply integrated into enterprise workflows. Ransomware operators exploit this vulnerability to gain code execution on the SharePoint server, from which they can encrypt document libraries, move laterally through the network, and deploy ransomware across the organization.
How does CVE-2023-24955 chain with CVE-2023-29357?
CVE-2023-29357 is a privilege escalation vulnerability that allows an unauthenticated attacker to impersonate a Site Owner on SharePoint Server. When chained with CVE-2023-24955, the attacker first uses CVE-2023-29357 to gain Site Owner privileges without authentication, then uses CVE-2023-24955 to execute arbitrary code, creating a complete unauthenticated RCE chain.
Which SharePoint versions are affected?
SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition are all affected. Microsoft has released patches for all supported versions through the Microsoft Security Response Center.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.