CVE-2023-29357

2023-06-1400:00:00

attackerkb.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.107 Low

EPSS

Percentile

94.6%

JSON

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Recent assessments:

cbeek-r7 at January 17, 2024 10:31am UTC reported:

CVE-2023-29357 is a critical vulnerability in Microsoft SharePoint Server, classified as an Elevation of Privilege (EoP) flaw. . This vulnerability allows attackers to use spoofed JSON web tokens (JWTs) to gain Administrator privileges on the SharePoint host. The exploit does not require the attacker to have any privileges or for the user to perform any action

The vulnerability was identified by Nguyễn Tiến Giang (Jang) of StarLabs SG and demonstrated at ZDI’s Pwn2Own hacking contest in March 2023. In September 2023, a technical writeup of the flaw and its use in a two-bug exploit chain to achieve pre-authentication remote code execution (RCE) on the SharePoint server was published, along with proof-of-concept (PoC) code demonstrating the attack. Write-up link: <https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/>

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 4