CVE-2023-29357
Microsoft SharePoint Server Privilege Escalation Vulnerability
Description
CVE-2023-29357 is a critical elevation of privilege vulnerability in Microsoft SharePoint Server, rated CVSS 9.8 out of 10. The flaw stems from improper authentication logic (CWE-303), which allows a remote unauthenticated attacker to impersonate a legitimate user by presenting a spoofed JWT authentication token. Because no credentials, user interaction, or special network position are required, exploitation is straightforward for any attacker who can reach the SharePoint web interface. This vulnerability has been confirmed exploited in the wild, is listed in CISA’s Known Exploited Vulnerabilities catalog, and has been associated with ransomware campaigns, underscoring the urgency of patching.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29357(US Government Resource)
Weakness Type
CWE-303: Incorrect Implementation of Authentication Algorithm
CVE-2023-29357 is rooted in CWE-303 — Incorrect Implementation of Authentication Algorithm. SharePoint Server failed to correctly verify the integrity and authenticity of JSON Web Tokens (JWTs) used for user authentication. Specifically, the server accepted tokens that were not properly signed or validated, allowing an attacker to forge a token that impersonates any existing SharePoint user, including administrators.
This class of weakness is particularly severe because authentication bypass grants an attacker the identity of a privileged user without requiring knowledge of credentials. The entire access control boundary of the application becomes ineffective once authentication can be bypassed.
Impact Analysis
CVE-2023-29357 carries a CVSS 3.1 base score of 9.8 (CRITICAL) with full High ratings across all three impact dimensions.
Confidentiality (High): An attacker who successfully spoofs an administrator or privileged SharePoint user gains unrestricted read access to all documents, lists, site collections, and configuration data stored in the affected SharePoint environment. Sensitive business data, intellectual property, or personal information accessible to the impersonated account are fully exposed.
Integrity (High): With a privileged impersonated identity, the attacker can create, modify, or delete SharePoint content, alter site settings, add malicious web parts, or introduce backdoors into SharePoint workflows. In chained exploitation scenarios (e.g., combined with CVE-2023-24955 remote code execution), attackers can achieve full server compromise.
Availability (High): Attackers may disrupt SharePoint operations by deleting critical content, altering configurations, or triggering resource-exhausting actions. Ransomware operators have leveraged this vulnerability, meaning encrypted or destroyed data is a realistic outcome.
The EPSS score of 0.944 (99.96th percentile) confirms that exploitation of CVE-2023-29357 is extremely likely, and observed in the wild.
Exploit Maturity
CVE-2023-29357 has a very high exploit maturity. The EPSS score of 0.944 places this vulnerability in the 99.96th percentile, reflecting near-certainty of exploitation attempts in the wild.
Active exploitation confirmed: CISA added this CVE to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 31, 2024. The vulnerability has been confirmed exploited in real-world attacks, including campaigns associated with ransomware operators.
Chained exploitation: Researchers and threat actors have demonstrated chaining CVE-2023-29357 with CVE-2023-24955 (a remote code execution vulnerability in SharePoint) to achieve unauthenticated remote code execution. This two-stage chain makes the authentication bypass even more dangerous, as it provides a path from network access to full server takeover without any credentials.
Public proof-of-concept: Exploit code for CVE-2023-29357 has been publicly disclosed and is available in exploit repositories, significantly lowering the bar for less sophisticated attackers.
Remediation
- Apply the Microsoft Security Update immediately. Microsoft released patches for CVE-2023-29357 in the June 2023 Patch Tuesday update. All supported SharePoint Server versions (SharePoint Server 2019 and applicable versions) must be patched using updates published in the Microsoft Security Response Center advisory.
- Enable AMSI integration on SharePoint. Microsoft recommends enabling Antimalware Scan Interface (AMSI) integration with SharePoint Server as a defense-in-depth measure that can help detect and block malicious request patterns used in exploitation attempts.
- Review SharePoint access logs for anomalous authentication events. Investigate logs for suspicious JWT token usage, unexpected privilege escalation, or access patterns inconsistent with legitimate user behavior, especially during the period prior to patching.
- Restrict network access to SharePoint. Where operationally feasible, limit internet-facing exposure of SharePoint Server using WAF rules, network segmentation, or VPN-gating to reduce the attack surface.
- Discontinue use if patching is not possible. Per the CISA KEV guidance, if mitigations cannot be applied, consider discontinuing use of the affected product until the vulnerability can be remediated.
- Monitor for ransomware indicators. Given the confirmed ransomware association, ensure endpoint detection and response (EDR) tools are active on SharePoint hosts and monitor for indicators associated with known ransomware families.
Technical Details
CVE-2023-29357 exploits a flaw in how Microsoft SharePoint Server handles JWT-based authentication tokens. SharePoint uses JSON Web Tokens as part of its claims-based authentication model. The vulnerability exists because the server improperly validates the signature and integrity of incoming JWTs.
Attack mechanism: An attacker crafts a JWT token with a forged identity claim — for example, impersonating a site collection administrator — and presents this token to SharePoint’s web interface. Because the server’s authentication logic does not correctly reject invalid or unsigned tokens (CWE-303), it treats the forged token as legitimate and grants access accordingly.
No authentication required: The attack vector is Network, attack complexity is Low, and no privileges or user interaction are required (AV:N/AC:L/PR:N/UI:N), making this exploitable by any unauthenticated remote attacker.
Chaining potential: When combined with CVE-2023-24955 (SharePoint Server Remote Code Execution), the authentication bypass provides the access level needed to trigger the RCE flaw, resulting in a fully unauthenticated remote code execution chain against SharePoint Server.
Frequently Asked Questions
What is CVE-2023-29357?
CVE-2023-29357 is a critical elevation of privilege vulnerability in Microsoft SharePoint Server. It allows remote unauthenticated attackers to bypass authentication by forging JWT tokens, effectively impersonating legitimate users including administrators. The vulnerability is caused by CWE-303 (Incorrect Implementation of Authentication Algorithm).
Which products are affected by CVE-2023-29357?
Microsoft SharePoint Server is the affected product. The vulnerability was disclosed in June 2023 and affects SharePoint Server versions that had not been updated with the June 2023 or later security patches from Microsoft. Organizations running Microsoft SharePoint Server on-premises should verify their patch status immediately.
How do I fix CVE-2023-29357?
Apply the security update released by Microsoft as part of the June 2023 Patch Tuesday cycle. The patch is available through the Microsoft Security Response Center at msrc.microsoft.com. Additionally, enable AMSI integration and review authentication logs for signs of prior exploitation. If patching is not immediately possible, restrict network access to the SharePoint deployment.
How severe is CVE-2023-29357?
CVE-2023-29357 carries the maximum CRITICAL severity rating with a CVSS 3.1 score of 9.8 out of 10. Its EPSS score of 0.944 places it in the 99.96th percentile for exploitation likelihood. The vulnerability has been confirmed exploited in the wild and is associated with ransomware campaigns, making it one of the most urgently actionable SharePoint vulnerabilities ever disclosed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.