CISA Warns: Hackers Actively Attacking Microsoft SharePoint Vulnerability

CVE-2023-24955 is a code injection vulnerability (CWE-94) in on-premises Microsoft SharePoint Server that enables remote code execution over the network (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N). Exploitation requires authentication with high privileges — e.g., a SharePoint site administrator account — and no user interaction, so an attacker who has obtained elevated site credentials can send crafted requests that execute code on the SharePoint server. A successful attacker gains code execution in the context of the SharePoint service, with high impact on confidentiality, integrity, and availability, providing a foothold for lateral movement or ransomware deployment. Organizations running affected on-premises SharePoint Server releases are affected; the flaw was demonstrated at Pwn2Own and Microsoft patched it in the May 2023 Patch Tuesday updates. The bug is now exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-03-26 with known ransomware use, and EPSS places its 30-day exploitation probability at 85.4% (100th percentile).

Do: Apply Microsoft's May 2023 (or later) security updates for SharePoint Server immediately, prioritizing internet-facing servers; CISA's KEV entry requires federal agencies to apply vendor mitigations or discontinue use of the product. Audit and tighten accounts holding SharePoint site-administrator rights, and hunt for signs of exploitation such as unexpected site-admin activity or unusual process launches from SharePoint service accounts. Public reporting on the 2024 exploitation suggests it may be chained with SharePoint privilege-escalation flaw CVE-2023-29357 to achieve unauthenticated access, so ensure both flaws are patched.

Microsoft SharePoint Server contains a privilege escalation flaw (CWE-303, incorrect implementation of an authentication algorithm) in which an attacker can forge (spoof) JSON Web Token (JWT) authentication tokens that the server accepts as valid. An unauthenticated remote attacker who presents such spoofed tokens bypasses authentication entirely and gains administrator privileges on the affected SharePoint deployment. Organizations running on-premises Microsoft SharePoint Server are affected, including both internet-facing and internally hosted servers. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public proof-of-concept is catalogued, but the KEV listing and perfect EPSS score make urgent patching critical.

Do: Apply Microsoft's SharePoint Server security updates immediately (the fix shipped in Microsoft's March 2023 Patch Tuesday updates for supported SharePoint Server versions), consistent with the CISA KEV required action. Until patched, restrict internet exposure of SharePoint servers and review authentication logs for anomalous or spoofed-token activity, hunting for signs of compromise given known ransomware use. If mitigations are unavailable, CISA advises discontinuing use of the product.