CVE-2023-24954: SharePoint Server Info Disclosure Flaw

CVE-2023-24954 Overview

CVE-2023-24954 is a Microsoft SharePoint Server Information Disclosure Vulnerability that allows authenticated attackers to gain unauthorized access to sensitive information. This vulnerability, classified as a Server-Side Request Forgery (SSRF) weakness (CWE-918), enables attackers with low-privilege access to exploit the vulnerability over the network without requiring user interaction, potentially exposing confidential data stored on SharePoint servers and connected Windows systems.

Critical Impact

Authenticated attackers can exploit this vulnerability to disclose sensitive information from Microsoft SharePoint Server environments, potentially compromising confidential business data, user credentials, and internal network resources.

Affected Products

• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Enterprise Server 2016
• Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2)
• Microsoft Windows Server 2008 SP2 and R2 SP1
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2022

Discovery Timeline

• May 9, 2023 - CVE-2023-24954 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-24954

Vulnerability Analysis

This information disclosure vulnerability stems from improper handling of server-side requests within Microsoft SharePoint Server. The underlying weakness is categorized as CWE-918, indicating a Server-Side Request Forgery (SSRF) condition where the application can be manipulated into making unauthorized requests to internal or external resources.

An attacker with valid credentials (low privileges required) can exploit this vulnerability remotely over the network. The attack requires no user interaction and has low complexity, making it relatively straightforward to execute once authentication is achieved. While the vulnerability does not allow attackers to modify data or disrupt services, it provides high confidentiality impact, enabling unauthorized access to sensitive information that should be protected.

The vulnerability affects a wide range of Microsoft products, including multiple versions of SharePoint Server and various Windows operating systems, indicating that the underlying issue may be present in a shared component or API used across these platforms.

Root Cause

The root cause of CVE-2023-24954 is a Server-Side Request Forgery (SSRF) weakness in Microsoft SharePoint Server. This occurs when the application fails to properly validate or sanitize user-controlled input that is used to construct server-side requests. As a result, an authenticated attacker can manipulate the application into making requests to unintended destinations, potentially exposing internal resources, metadata, or sensitive configuration information.

Attack Vector

The attack vector for this vulnerability is network-based, requiring the attacker to have authenticated access to the SharePoint environment. The exploitation process involves:

1. Authentication: The attacker must first authenticate to the SharePoint server with at least low-level privileges
2. Request Manipulation: The attacker crafts malicious requests that exploit the SSRF weakness
3. Information Extraction: The server processes these requests and returns sensitive data to the attacker

The vulnerability can be exploited through specially crafted requests to SharePoint Server endpoints that fail to properly validate the target of server-side requests. For detailed technical analysis, refer to the Microsoft Security Update Guide.

Detection Methods for CVE-2023-24954

Indicators of Compromise

• Unusual outbound requests originating from SharePoint Server to internal resources or metadata endpoints
• Anomalous access patterns by authenticated users querying internal network resources through SharePoint
• Unexpected information retrieval requests in SharePoint server logs that target internal IP addresses or hostnames
• Authentication logs showing repeated access attempts followed by unusual API calls

Detection Strategies

• Monitor SharePoint server logs for suspicious HTTP requests that may indicate SSRF exploitation attempts
• Implement network traffic analysis to detect unusual outbound connections from SharePoint servers to internal resources
• Deploy web application firewall (WAF) rules to identify and block SSRF attack patterns
• Enable enhanced SharePoint audit logging to capture detailed information about server-side request activities

Monitoring Recommendations

• Configure SIEM alerts for abnormal SharePoint server request patterns targeting internal network resources
• Implement egress filtering and monitoring to detect unexpected server-side connections
• Review SharePoint access logs regularly for authenticated users accessing sensitive information outside their normal patterns
• Monitor for reconnaissance activities that may precede exploitation attempts

How to Mitigate CVE-2023-24954

Immediate Actions Required

• Apply the latest Microsoft security updates for all affected SharePoint Server and Windows versions immediately
• Review and restrict network access to SharePoint servers, limiting connectivity to trusted resources only
• Implement the principle of least privilege for SharePoint user accounts to minimize potential exposure
• Enable enhanced logging and monitoring on SharePoint servers to detect exploitation attempts

Patch Information

Microsoft has released security updates to address CVE-2023-24954. Organizations should apply the appropriate patches for their SharePoint Server and Windows versions as documented in the Microsoft Security Update Guide for CVE-2023-24954. The updates address the underlying SSRF weakness by implementing proper validation of server-side requests.

Affected versions requiring patches include:

• SharePoint Server Subscription Edition
• SharePoint Server 2019
• SharePoint Enterprise Server 2016
• Multiple Windows 10 and Windows 11 versions
• Windows Server 2008 through 2022

Workarounds

• Implement network segmentation to restrict SharePoint server access to internal resources
• Configure firewall rules to limit outbound connections from SharePoint servers to only necessary destinations
• Review and harden SharePoint authentication mechanisms to ensure only authorized users have access
• Consider deploying a reverse proxy or WAF with SSRF protection capabilities in front of SharePoint servers

# Example: Review SharePoint server outbound connections
# Monitor for unusual requests to internal resources
Get-NetTCPConnection -State Established | Where-Object {$_.OwningProcess -match "w3wp"} | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort