Remote Code Execution Vulnerability Affects Microsoft SharePoint Server
CVE-2023-24955

7.2HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Sharepoint Enterprise Server 2016; Microsoft Sharepoint Server 2019; Microsoft Sharepoint Server Subscription Edition
Vendor: CVE Published:; 9 May 2023

Badges

📈 Trended💰 Ransomware👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2023-24955?

CVE-2023-24955 is a critical remote code execution vulnerability affecting Microsoft SharePoint Server. SharePoint Server is a collaborative platform that organizations use for document management, storage, and web application development. This vulnerability could potentially allow an attacker to execute arbitrary code on affected systems, which poses a significant threat to organizations that rely on SharePoint for their operations. Exploitation of this vulnerability could lead to unauthorized access, data breaches, and significant operational disruptions, jeopardizing sensitive information and organizational integrity.

Technical Details

CVE-2023-24955 occurs due to improper validation within the SharePoint Server. Attackers can exploit this flaw by sending specially crafted requests to the SharePoint Server, which can then result in the execution of malicious code with the privileges of the server application. The nature of the vulnerability involves remote exploitation, meaning attackers do not need physical access to the systems to carry out their attacks. This can potentially affect all versions of SharePoint Server that are vulnerable, making the risk widespread among organizations using this software.

Potential impact of CVE-2023-24955

Unauthorized System Access: Successful exploitation of this vulnerability can provide attackers with full control over affected SharePoint servers, allowing them to access sensitive corporate data and internal systems.
Data Breach and Theft: With the ability to execute arbitrary code, malicious actors could exfiltrate sensitive information such as personal data, intellectual property, and confidential business documents.
Operational Disruption: Compromised systems could lead to operational downtime, affecting business continuity. Attackers could leverage this vulnerability to deploy ransomware, further amplifying the impact by encrypting critical data and demanding ransom for recovery.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5395.1000

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10398.20000

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.16130.20420

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-24955-PoC
Created by former-farmer