CVE-2023-24955: Microsoft SharePoint Server Code Injection Vulnerability

CVE-2023-24955 is a code injection vulnerability in Microsoft SharePoint Server. An authenticated attacker who already holds Site Owner privileges can abuse it to execute code remotely on the server. Because SharePoint often stores sensitive collaboration data and is a common target for ransomware operators, this flaw matters for any organization running on-premises SharePoint Server. Confirm all version and patch details against the official Microsoft advisory.

CISA notes that the vulnerability has been used in ransomware campaigns and requires organizations to apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

How it works

The underlying weakness is CWE-94 (code injection). In this class of flaw, an application fails to properly validate or sanitize input that is later treated as executable code. According to the CISA summary, an attacker who already possesses Site Owner privileges on a SharePoint Server instance can inject malicious code that the server then executes with the privileges of the SharePoint process. The attack therefore requires authentication and elevated SharePoint rights; it is not a remote unauthenticated exploit. Exact injection vectors and payloads are not detailed in the public summary and must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Microsoft SharePoint Server is typically deployed on-premises as a collaboration and document-management platform, often integrated with Active Directory and exposed to internal users or via reverse proxies. Inventory every SharePoint Server farm, including development, staging, and production instances. Check the installed product version and cumulative update level against the Microsoft security advisory for CVE-2023-24955; only the advisory lists the precise builds that are vulnerable or fixed.

• Query your configuration-management database or use PowerShell SharePoint cmdlets to list server roles and build numbers.
• Review Site Owner membership across site collections; any account with those rights is a potential abuse vector.
• Examine SharePoint ULS logs, IIS logs, and Windows event logs for anomalous activity originating from Site Owner accounts, such as unexpected file uploads, web-part modifications, or process creation under the SharePoint application pool identity.
• If you run endpoint detection and response tooling, look for unusual child processes spawned by w3wp.exe or owstimer.exe that coincide with Site Owner sessions.

Telemetry signs of exploitation are not exhaustively published; treat any unexplained remote code execution under SharePoint service accounts as suspicious and escalate for forensic review.

How to remediate

Patch first. Apply the security update Microsoft released for this vulnerability, following the exact guidance and prerequisites listed in the vendor advisory. After installation, verify the new build number and restart the relevant SharePoint services. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Beyond the patch, harden the SharePoint environment for this class of issue:

• Enforce least privilege for Site Owner roles; remove unnecessary accounts and require multi-factor authentication for administrative access.
• Enable SharePoint’s built-in antivirus and malware scanning features where available.
• Restrict the ability of Site Owners to upload or activate custom solutions and web parts unless business need is documented.
• Keep the underlying Windows Server and .NET Framework fully patched, because SharePoint relies on those components.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Network segmentation: place SharePoint servers in a restricted VLAN or application zone; allow only necessary management and user traffic.
• Virtual patching or WAF rules: if a web application firewall is in front of SharePoint, enable any vendor-supplied or community signatures that target code-injection patterns against SharePoint endpoints; test carefully to avoid breaking legitimate functionality.
• Disable or tightly control features that allow Site Owners to introduce executable content (custom scripts, sandboxed solutions, or certain web parts) if business processes permit.
• Heighten monitoring: increase log retention and alerting on Site Owner actions, process creation under SharePoint identities, and outbound connections from SharePoint servers.
• If no effective mitigation exists, follow CISA guidance and plan to discontinue use of the affected product until a patch can be deployed.

If your data may have been exposed

Actively exploited vulnerabilities of this type have been leveraged by ransomware groups. If you discover evidence of compromise, isolate affected servers, preserve logs, and engage incident-response procedures. Review SharePoint content and permissions for unauthorized changes. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether credentials associated with your organization have already appeared in public dumps.