CISA Adds 9.8 'Critical' Microsoft SharePoint Bug to its KEV Catalog

It's a tale as old as time: an old, long-since patched vulnerability that remains actively exploited.

1 Min Read
Desktop screen showing the SharePoint logo
Source: Monticello via Shutterstock

On Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) added a privilege escalation vulnerability affecting Microsoft SharePoint servers to its list of Known Exploited Vulnerabilities (KEV).

SharePoint is a popular, cloud-based document management and storage system, which is also variously used by companies to implement internal applications and business processes, and share resources via an intranet. As recently as 2020, it enjoyed more than 200 million active monthly users.

The latest addition to KEV, CVE-2023-29357, is a "critical" 9.8 out of 10 vulnerability on the CVSS scale, affecting SharePoint Server 2016 and 2019. With no user engagement required, it allows an attacker to bypass authentication checks and gain administrative access to a server using spoofed JSON Web Token (JWT) authentication tokens.

Researchers first demonstrated the utility of CVE-2023-29357 at March 2023's Pwn2Own event, combining it with a second SharePoint vulnerability to create a successful exploit chain — and winning $100,000 in the process. Another independent researcher developed a proof-of-concept (PoC) exploit in September.

Microsoft issued a patch back in June. However, it's still being actively exploited, according to CISA's new alert. In a Mastodon post on Thursday, security researcher Kevin Beaumont provided a bit of extra context, writing that "I am aware of one ransomware group that finally has a working exploit for this."

For organizations still in the firing line, the June patch can be found here.

About the Author(s)

Nate Nelson, Contributing Writer

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights