CVE-2023-29357: SharePoint Server Privilege Escalation

CVE-2023-29357 Overview

CVE-2023-29357 is a critical elevation of privilege vulnerability affecting Microsoft SharePoint Server 2019. This vulnerability allows an attacker who has gained access to spoofed JWT authentication tokens to bypass authentication and gain the privileges of an authenticated user without any user interaction. The flaw relates to improper authentication handling (CWE-303: Incorrect Implementation of Authentication Algorithm), enabling attackers to impersonate legitimate users and potentially gain administrative access to SharePoint environments.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can gain elevated privileges on SharePoint Server without authentication, potentially leading to complete system compromise and unauthorized access to sensitive organizational data.

Affected Products

• Microsoft SharePoint Server 2019

Discovery Timeline

• 2023-06-14 - CVE-2023-29357 published to NVD
• 2025-10-28 - Last updated in NVD database

Technical Details for CVE-2023-29357

Vulnerability Analysis

This vulnerability stems from improper handling of authentication mechanisms within Microsoft SharePoint Server 2019. The flaw allows attackers to exploit weaknesses in how SharePoint validates JSON Web Tokens (JWT), enabling authentication bypass without requiring valid credentials or user interaction. Given the network-accessible nature of SharePoint deployments and the low complexity required to exploit this vulnerability, it presents a significant risk to organizations running vulnerable versions.

The impact of successful exploitation is severe, potentially allowing attackers to gain administrative privileges on the SharePoint server. This could lead to unauthorized access to sensitive documents, modification or deletion of content, deployment of malicious code, or lateral movement within the organization's network.

Root Cause

The root cause of CVE-2023-29357 lies in the incorrect implementation of authentication algorithms (CWE-303) within Microsoft SharePoint Server. Specifically, the vulnerability exists in how SharePoint processes and validates JWT authentication tokens. When authentication checks are improperly implemented, attackers can craft spoofed JWT tokens that the server incorrectly accepts as valid, bypassing normal authentication controls and granting unauthorized access.

Attack Vector

The attack vector for CVE-2023-29357 is network-based, meaning attackers can exploit this vulnerability remotely without requiring prior authentication or user interaction. An attacker who obtains or generates spoofed JWT authentication tokens can send malicious requests to a vulnerable SharePoint Server instance over the network. The server processes these tokens without proper validation, granting the attacker elevated privileges. This attack requires no special conditions such as race conditions or specific configurations, making it highly exploitable across affected deployments.

The vulnerability does not require any privileges to exploit and does not need victim interaction, making it particularly dangerous. Successful exploitation allows attackers to impersonate authenticated users, including those with administrative privileges.

Detection Methods for CVE-2023-29357

Indicators of Compromise

• Unusual authentication patterns in SharePoint logs, particularly successful authentications with anomalous JWT token characteristics
• Unauthorized administrative actions or privilege changes within SharePoint environments
• Suspicious API calls to SharePoint endpoints from unexpected sources or with malformed tokens
• Evidence of data exfiltration or unauthorized access to sensitive document libraries

Detection Strategies

• Monitor SharePoint ULS (Unified Logging Service) logs for authentication anomalies and failed/succeeded authentication attempts with suspicious patterns
• Implement network monitoring to detect unusual traffic patterns targeting SharePoint Server endpoints
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities on SharePoint servers
• Review Windows Security Event Logs for privilege escalation events (Event IDs 4672, 4648)

Monitoring Recommendations

• Enable comprehensive logging on SharePoint Server and centralize logs in a SIEM solution
• Configure alerts for administrative actions performed by accounts that don't typically perform such operations
• Monitor for lateral movement attempts originating from SharePoint servers
• Regularly audit user privileges and access patterns within SharePoint to detect anomalous activity

How to Mitigate CVE-2023-29357

Immediate Actions Required

• Apply Microsoft's security patches for SharePoint Server 2019 immediately, as this vulnerability is actively exploited
• Review SharePoint authentication logs for any signs of prior compromise
• Implement network segmentation to limit exposure of SharePoint servers to untrusted networks
• Consider temporarily restricting access to SharePoint if patching cannot be performed immediately

Patch Information

Microsoft has released security updates to address CVE-2023-29357. Organizations should consult the Microsoft Security Update Guide for detailed patching instructions and applicable security updates for SharePoint Server 2019. Given this vulnerability's inclusion in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance are required to remediate this vulnerability within mandated timeframes.

Workarounds

• Implement Web Application Firewall (WAF) rules to inspect and validate JWT tokens before they reach SharePoint servers
• Restrict network access to SharePoint servers using firewall rules, allowing only trusted IP ranges
• Enable multi-factor authentication (MFA) for all SharePoint users, particularly administrative accounts
• Consider using Azure AD authentication with conditional access policies to add additional security layers

# Verify SharePoint Server patch level
Get-SPFarm | Select BuildVersion

# Review recent authentication events in SharePoint ULS logs
Get-SPDiagnosticConfig | Select -ExpandProperty LogLocation