SharePoint Server exploit chain: Critical RCE flaws
Microsoft SharePoint Server flaws CVE-2023-29357 and CVE-2023-24955 can be chained for unauthenticated remote code execution. The flaws affect SharePoint Server 2019, with CVE-2023-24955 also affecting Enterprise Server 2016 and Subscription Edition; apply Microsoft's June 2023 and May 2023 security updates, respectively.
Summary written with AI from this article, and checked against it.
Affected systems and impact
| Flaw | Affected systems | Impact |
|---|---|---|
| CVE-2023-29357Spoofed JSON Web Token allows authentication bypass | Microsoft SharePoint Server 2019 | A remote, unauthenticated attacker gains authenticated user privileges without user interaction |
| CVE-2023-24955Replacement of /BusinessDataMetadataCatalog/BDCMetadata.bdcm leads to execution of a compiled assembly | Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server Subscription Edition | An authenticated Site Owner can execute arbitrary code on the SharePoint Server |
A proof-of-concept exploit chain for two critical vulnerabilities in Microsoft SharePoint Server has been recently disclosed. These vulnerabilities, if exploited, could lead to unauthenticated remote code execution (RCE). This concerning development was detailed in a blog post by a STAR Labs researcher and demonstrated during the Zero Day Initiative’s Pwn2Own contest.
Detailed Analysis of the Vulnerabilities
The exploit chain combines two distinct vulnerabilities in Microsoft SharePoint Server:
- CVE-2023-29357: This is an elevation of privilege (EoP) vulnerability with a high CVSSv3 score of 9.8. It allows a remote, unauthenticated attacker to send a spoofed JSON Web Token (JWT) to the vulnerable server, thereby gaining the privileges of an authenticated user without the need for user interaction.
- CVE-2023-24955: Rated with a CVSSv3 score of 7.2, this remote code execution (RCE) vulnerability enables an authenticated Site Owner to execute arbitrary code on the affected SharePoint Server. The vulnerability is exploited by replacing the /BusinessDataMetadataCatalog/BDCMetadata.bdcm file, which compiles into an assembly executed by SharePoint.
Both vulnerabilities have been addressed in Microsoft's Patch Tuesday releases, with CVE-2023-29357 patched in June 2023 and CVE-2023-24955 in May 2023.
Public Exploit Script and Its Implications
A public exploit script targeting CVE-2023-29357 has been released on GitHub, enabling attackers to escalate privileges on compromised SharePoint Server installations. By chaining this EoP vulnerability with the RCE vulnerability CVE-2023-24955, attackers can significantly compromise system confidentiality, integrity, and availability.
Affected Products
- CVE-2023-29357 impacts Microsoft SharePoint Server 2019.
- CVE-2023-24955 affects Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, and Microsoft SharePoint Server Subscription Edition.
Recommendations for Mitigation
- Install Security Updates: It is critical to install all related security updates for the affected software. Patches for CVE-2023-29357 and CVE-2023-24955 are available and should be applied immediately.
- Enable AMSI Integration: Microsoft recommends enabling AMSI (Antimalware Scan Interface) integration and using Microsoft Defender across SharePoint Server farms for additional protection.
- Follow Microsoft's Guidance: A step-by-step guide for implementing AMSI with SharePoint Server is available in Microsoft's official documentation.
Conclusion
The public availability of the exploit chain significantly increases the risk of these vulnerabilities being leveraged by malicious actors. It is imperative for organizations using Microsoft SharePoint Server to promptly apply the recommended patches and mitigations to prevent potential security breaches and data compromises.
The revelation of this exploit chain for Microsoft SharePoint Server vulnerabilities underscores the importance of timely patch management and proactive security measures in enterprise environments. Staying vigilant and updated on the latest cybersecurity threats and solutions is essential to safeguard sensitive information and maintain system integrity in the face of evolving cyber threats.
Interview flashcards
What can attackers achieve by chaining CVE-2023-29357 and CVE-2023-24955 in SharePoint Server?
Attackers can achieve unauthenticated remote code execution. The chain combines an elevation of privilege vulnerability with a remote code execution vulnerability, threatening system confidentiality, integrity, and availability.
How does CVE-2023-29357 allow an attacker to elevate privileges?
A remote, unauthenticated attacker sends a spoofed JSON Web Token (JWT) to gain the privileges of an authenticated user. No user interaction is required, and the vulnerability has a CVSSv3 score of 9.8.
How is CVE-2023-24955 exploited in SharePoint Server?
An authenticated Site Owner replaces /BusinessDataMetadataCatalog/BDCMetadata.bdcm, which compiles into an assembly executed by SharePoint. This enables arbitrary code execution; the vulnerability has a CVSSv3 score of 7.2.
Which SharePoint products are affected by CVE-2023-29357 and CVE-2023-24955?
CVE-2023-29357 affects Microsoft SharePoint Server 2019. CVE-2023-24955 affects Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, and Microsoft SharePoint Server Subscription Edition.
When did Microsoft patch CVE-2023-29357 and CVE-2023-24955?
Microsoft patched CVE-2023-29357 in June 2023 and CVE-2023-24955 in May 2023 through Patch Tuesday releases. All related security updates for affected software should be applied immediately.
What additional protection does Microsoft recommend for SharePoint Server farms against this exploit chain?
Microsoft recommends enabling AMSI (Antimalware Scan Interface) integration and using Microsoft Defender across SharePoint Server farms. Microsoft's official documentation provides a step-by-step guide for implementing AMSI with SharePoint Server.
Written with AI from this article, and checked against it.
About the author
Vishal · Software & security engineerVishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
