The Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2023-29357 to its Known Exploited Vulnerabilities (KEV) catalog, according to BleepingComputer. This critical CVE identifies an elevation of privilege flaw in Microsoft SharePoint Server that allows remote attackers to gain administrator privileges by bypassing JSON Web Token (JWT) authentication. The vulnerability carries a CVSS score of 9.8, reflecting its high exploitability and severe impact on confidentiality, integrity, and availability. While Microsoft released patches for this issue in June 2023, active exploitation in the wild demonstrates that many organizations have failed to secure their on-premises infrastructure.
Technical Analysis of the SharePoint Exploit Chain
CVE-2023-29357 stems from the improper validation of JWTs within the SharePoint authentication process. By sending a specially crafted token, an unauthenticated attacker can bypass security checks and perform Privilege Escalation to the level of a site administrator. This specific flaw is often paired with CVE-2023-24955, a critical RCE vulnerability that allows a privileged user to execute arbitrary code on the server. When these two vulnerabilities are chained together, they provide a direct path for unauthenticated remote code execution, a scenario that poses a significant risk to organizational data and network integrity.
Researchers from Star-Labs originally demonstrated this chain during the Pwn2Own Vancouver 2023 hacking contest. The demonstration proved that an attacker could navigate the SharePoint environment, manipulate site content, and potentially achieve Lateral Movement within the internal network after the initial breach. Because SharePoint often integrates with Active Directory and contains sensitive corporate documents, the successful exploitation of this chain allows for extensive data exfiltration and long-term persistence within the target environment.
How to Detect CVE-2023-29357 Exploit Attempts
Understanding how to detect CVE-2023-29357 exploit attempts requires a multi-layered monitoring strategy within the SOC. Security teams should prioritize analyzing web server logs for unusual authentication patterns, specifically looking for JWTs that do not align with established identity provider signatures. Implementation of SIEM rules to flag unauthorized access to SharePoint administrative endpoints is a priority. Defenders should also map observed behaviors against the MITRE ATT&CK framework, focusing on techniques such as Exploitation for Privilege Escalation (T1068) and Exploitation for Client Execution (T1203).
Because the exploit involves bypassing authentication, typical login-failure alerts may not trigger. Instead, analysts should monitor for unexpected process spawning from the SharePoint application pool (w3wp.exe), such as cmd.exe or powershell.exe, which often indicates the secondary stage of an RCE attack has been initiated. Network-level inspection of inbound traffic to SharePoint ports—usually 80 or 443—for anomalous headers or binary payloads is also a recommended detection method.
CVE-2023-29357 Patch Guidance and Remediation
The primary SharePoint Server RCE mitigation consists of applying the cumulative security updates provided by Microsoft in June 2023 or later. Organizations running SharePoint Server 2019 or SharePoint Server Subscription Edition must ensure their instances are updated to the latest build. Administrators should verify the patch level by checking the version number in the SharePoint Central Administration console or by using administrative PowerShell cmdlets to confirm the presence of the June updates.
In addition to patching, security professionals should consider the following steps to harden their SharePoint environments:
- Implement the principle of least privilege by restricting administrative access to SharePoint services to a minimal number of accounts.
- Utilize a Web Application Firewall (WAF) with updated signatures to block known exploit patterns associated with JWT bypasses and improper authentication requests.
- Isolate SharePoint servers from the public internet where possible, requiring a VPN or Zero Trust access gateway for all remote users.
Given the current active exploitation, the window for remediation is closing rapidly. Organizations that cannot patch immediately should investigate for IoC related to recent unauthorized administrative activities on their SharePoint farms, as the addition to the CISA KEV catalog indicates that threat actors are currently utilizing these flaws to breach enterprise perimeters.