Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVE-2023-29357) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft SharePoint Server 2019 and SharePoint Server Subscription Edition.
An unauthenticated attacker can send a specially crafted JWT token to bypass authentication, gain administrator privileges, and potentially chain it with RCE vulnerabilities.
Apply the official Microsoft Cumulative Update (CU) immediately and restrict unauthorized access at the network and IIS levels prior to patching.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official Microsoft Cumulative Update (CU). Run the SharePoint Products Configuration Wizard after installing the patch to complete the update process.
# Verify current SharePoint build version
Get-SPFarm | Select-Object BuildVersion
# Run the configuration wizard to apply the patch to the database
PS C:\> PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd features -install2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, configure IIS URL Rewrite rules to block external OAuth requests or restrict access to SharePoint APIs to trusted internal networks only.
<!-- Example IIS web.config rule to block external Bearer token requests -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='Block_External_OAuth' stopProcessing='true'>
<match url='.*' />
<conditions>
<add input='{HTTP_AUTHORIZATION}' pattern='^Bearer\s(.*)' />
<add input='{REMOTE_ADDR}' pattern='^10\.0\.' negate='true' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Access Denied' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
Use the following PowerShell script to inspect IIS W3C logs for suspicious Bearer token usage or unauthorized API calls from external IP addresses.
# Search IIS logs for requests containing Bearer tokens
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*'
Select-String -Path $LogPath -Pattern 'Bearer' |
Select-Object -First 50 |
Format-Table LineBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2023-29357 is a critical Elevation of Privilege (EoP) vulnerability in Microsoft SharePoint Server. The root cause lies in the improper validation of OAuth JSON Web Tokens (JWT) when SharePoint processes incoming API requests (CWE-303). SharePoint fails to properly validate the signature and specific claims of the JWT, allowing an attacker to present a self-signed or malformed token (such as using the 'none' algorithm or spoofing administrator claims) and bypass authentication entirely.
2. Exploitation Mechanics & Attack Scenario
An attacker targets the exposed SharePoint API endpoints and constructs a spoofed JWT containing the security identifier (SID) or claims of a high-privileged user, such as a Farm Administrator. By injecting this forged token into the HTTP Authorization header, the attacker bypasses the authentication handshake. The SharePoint server processes the request under the context of the spoofed administrator. In real-world attacks, this vulnerability is frequently chained with remote code execution (RCE) flaws (such as CVE-2023-24955) to achieve full system compromise.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an extreme risk to enterprise environments. Successful exploitation grants full administrative access to the SharePoint farm, enabling attackers to exfiltrate sensitive corporate data, intellectual property, and personal identifiable information (PII). Furthermore, it serves as a critical entry point for lateral movement within the Active Directory domain, potentially leading to ransomware deployment.
Official Vendor Advisories & References
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Frequently Asked SecOps Questions (CVE-2023-29357)
FAQQ1. How critical is CVE-2023-29357 and is it actively exploited in the wild?
CVE-2023-29357 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-29357?
Primary impacted vendors include microsoft across sharepoint_server. Scope summary: Microsoft SharePoint Server 2019 and SharePoint Server Subscription Edition (all supported builds prior to the June 2023 security updates).
Q3. What temporary mitigations or workarounds exist for CVE-2023-29357 before patching?
[Mitigation] Apply the official Microsoft Cumulative Update (CU) immediately and restrict unauthorized access at the network and IIS levels prior to patching. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-29357
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Weak Authentication Bypass Vulnerability (CVE-2026-55040) Security Advisory
[Affected Scope] Microsoft SharePoint Server on-premises deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.