CVE-2023-29357

Microsoft SharePoint Server contains a privilege escalation flaw (CWE-303, incorrect implementation of an authentication algorithm) in which an attacker can forge (spoof) JSON Web Token (JWT) authentication tokens that the server accepts as valid. An unauthenticated remote attacker who presents such spoofed tokens bypasses authentication entirely and gains administrator privileges on the affected SharePoint deployment. Organizations running on-premises Microsoft SharePoint Server are affected, including both internet-facing and internally hosted servers. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public proof-of-concept is catalogued, but the KEV listing and perfect EPSS score make urgent patching critical.

What to do: Apply Microsoft's SharePoint Server security updates immediately (the fix shipped in Microsoft's March 2023 Patch Tuesday updates for supported SharePoint Server versions), consistent with the CISA KEV required action. Until patched, restrict internet exposure of SharePoint servers and review authentication logs for anomalous or spoofed-token activity, hunting for signs of compromise given known ransomware use. If mitigations are unavailable, CISA advises discontinuing use of the product.