No Zero-Days but PGM Flaws Cause Patch Tuesday Concern
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-29357 | Privilege Escalation via JWT Authentication Bypass in Microsoft SharePoint Server Microsoft SharePoint Server contains a privilege escalation flaw (CWE-303, incorrect implementation of an authentication algorithm) in which an attacker can forge (spoof) JSON Web Token (JWT) authentication tokens that the server accepts as valid. An unauthenticated remote attacker who presents such spoofed tokens bypasses authentication entirely and gains administrator privileges on the affected SharePoint deployment. Organizations running on-premises Microsoft SharePoint Server are affected, including both internet-facing and internally hosted servers. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public proof-of-concept is catalogued, but the KEV listing and perfect EPSS score make urgent patching critical. Do: Apply Microsoft's SharePoint Server security updates immediately (the fix shipped in Microsoft's March 2023 Patch Tuesday updates for supported SharePoint Server versions), consistent with the CISA KEV required action. Until patched, restrict internet exposure of SharePoint servers and review authentication logs for anomalous or spoofed-token activity, hunting for signs of compromise given known ransomware use. If mitigations are unavailable, CISA advises discontinuing use of the product. | 9.8 | 100% | KEV ransomware |
| largetens of thousands of internet-exposed SharePoint servers, with likely 100,000+ total on-prem deployments | |
| CVE-2023-32015 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 2% |
| — |
Full article365 words · extracted from infosecurity-magazine.com · click to collapse
System administrators breathed a sigh of relief yesterday after Microsoft issued a relatively light patch update round, with no zero-day vulnerabilities and only six critical CVEs on the list.
However, there was still some work to do. Among the 78 CVEs addressed was a critical SharePoint elevation of privilege bug (CVE-2023-29357), which Adam Barnett, lead software engineer at Rapid7, said organizations should prioritize.
“Microsoft isn’t aware of public disclosure or in-the-wild exploitation, but considers exploitation more likely,” he added.
“At time of writing, the FAQ provided with Microsoft’s advisory suggests that both SharePoint Enterprise Server 2016 and SharePoint Server 2019 are vulnerable, but neither the advisory nor the SharePoint 2016 Release history list any related patches for SharePoint 2016. Defenders responsible for SharePoint 2016 will no doubt wish to follow up on this one as a matter of some urgency.”
There may also be more than one patch listed for a particular SharePoint version. If so, all of them must be installed to remediate the flaw, Barnett said.
Read more on Patch Tuesday: Microsoft Fixes Zero-Day Bug This Patch Tuesday.
Elsewhere, there were three critical remote code execution (RCE) vulnerabilities listed for Windows Pragmatic General Multicast (PGM) – the third Patch Tuesday in a row to feature at least one critical RCE bug in PGM. These are CVE-2023-32015, CVE-2023-32014, and CVE-2023-29363.
Mike Walters, VP of vulnerability and threat research at Action1, explained that the Windows PGM protocol is commonly used in video streaming and online gaming applications.
“These vulnerabilities have a high CVSS rating of 9.8 and pose a serious risk. They can be exploited over the network without requiring privileges or user interaction. Affected systems include all versions of Windows Server 2008 and later, as well as Windows 10 and later,” he warned.
“If the Windows Message Queuing Service is running in a PGM Server environment, an attacker could send a specially crafted file to achieve remote code execution. To mitigate this vulnerability, consider checking if the Message Queuing service is running on TCP port 1801 and disable it if not needed. However, be cautious as this may impact system functionality.”
Editorial image credit: monticello / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/no-zerodays-pgm-flaws-patch/