CVE-2023-29357: Microsoft SharePoint Server Privilege Escalation Vulnerability

CVE-2023-29357 is a privilege escalation vulnerability affecting Microsoft SharePoint Server. An unauthenticated attacker who has obtained spoofed JWT authentication tokens can use them to bypass authentication controls and obtain administrator privileges on the server.

This matters because the flaw enables full administrative control of SharePoint environments that host sensitive documents and collaboration data. Public reporting indicates the vulnerability has been used in ransomware operations, so organizations running SharePoint Server should prioritize assessment and remediation.

How it works

The issue is classified as CWE-303 and centers on improper handling of authentication material. According to the available summary, an attacker who has gained access to spoofed JWT authentication tokens can present those tokens in a network attack against SharePoint Server. The server accepts the tokens, authentication is bypassed, and the attacker is elevated to administrator privileges.

No further public detail is provided on the exact token-generation method, required network position, or precise request sequence. Defenders should treat the attack surface as any SharePoint endpoint that processes JWT-based authentication and must confirm the full technical description against the vendor advisory.

Am I affected? How to find it in your systems

Microsoft SharePoint Server is typically deployed on-premises within enterprise Windows Server environments that provide intranet portals, document libraries, and collaboration services. Cloud-hosted SharePoint Online is outside the scope of this CVE.

• Inventory all servers running SharePoint Server roles (web front-end, application, or database). Use configuration management databases, Windows inventory tools, or PowerShell queries against installed products to locate instances.
• Because exact affected version ranges are not stated in the provided facts, compare every discovered build against the vendor advisory to determine exposure.
• Review authentication and administrative audit logs for anomalous JWT presentation, unexpected elevation to farm or site-collection administrator accounts, or sudden creation of new privileged users. Correlate these events with external network sources that should not possess valid tokens.
• Check for unexpected changes to web-application policies, feature activations, or content databases that would indicate post-exploitation activity.

How to remediate

Apply the security update supplied by Microsoft for this vulnerability as the primary remediation. Follow the installation and verification steps published in the vendor advisory; CISA directs organizations to apply mitigations per those instructions or to discontinue use of the product if mitigations are unavailable.

• After patching, restart SharePoint services and validate that the updated binaries are loaded.
• For this class of authentication-bypass weakness, enforce strict JWT validation (issuer, audience, signature algorithm, and lifetime checks) wherever SharePoint integrates with identity providers.
• Remove or restrict any custom authentication providers or token-handling code that may weaken default controls.
• Re-audit all farm and site-collection administrator accounts and remove any that were added during the exposure window.

If you can't patch immediately

Until the vendor update can be installed, reduce risk with compensating controls:

• Segment SharePoint servers so that only authorized management and user networks can reach authentication endpoints; block direct internet exposure.
• Deploy virtual patching or web-application firewall rules that inspect and reject malformed or unexpected JWT claims if such signatures are available from the vendor or reputable threat-intelligence sources.
• Temporarily disable any non-essential authentication endpoints or features that accept JWT tokens if business requirements allow.
• Increase monitoring of authentication success events, privilege-change events, and administrative actions; forward these logs to a SIEM with alerts for anomalous patterns.
• If mitigations cannot be applied, plan to take the affected SharePoint instance offline until a patch is available, consistent with CISA guidance.

If your data may have been exposed

Because this vulnerability has been exploited in ransomware campaigns, successful compromise can lead to data theft, encryption, or lateral movement. Review SharePoint content databases, recycle bins, and external sharing logs for unauthorized access. Organizations should also consider running a free exposure scan of their email addresses against known breach data sets to determine whether credentials or personal information have already appeared in public dumps.