erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: May 9, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: SharePoint CVE-2023-24955 + 29357: Pwn2Own Chain Exploited. Owners of on-premises SharePoint Server 2016, 2019 or Subscription Edition farms that are internet-facing and not on current cumulative updates, or that missed the May and June 2023 updates for any period.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2023-24955, CVE-2023-29357

SharePoint CVE-2023-24955 + 29357: Pwn2Own Chain Exploited

Patched in May and June 2023 and long superseded; the real question is whether any on-prem farm still runs a pre-2023 build or was exposed and unpatched in early 2024, when exploitation was confirmed.

Must act: Owners of on-premises SharePoint Server 2016, 2019 or Subscription Edition farms that are internet-facing and not on current cumulative updates, or that missed the May and June 2023 updates for any period.

Can relax: SharePoint Online (Microsoft 365) customers, and on-prem farms that install SharePoint security updates every month and are not reachable from the internet.

  1. Run (Get-SPFarm).BuildVersion in the SharePoint Management Shell on every farm and compare it with the current monthly build, not just the 2023 fixed builds.
  2. Install the latest SharePoint security updates on every server in the farm, then run the configuration wizard so the farm build actually advances.
  3. Take SharePoint off the open internet or put it behind a VPN or an authenticating reverse proxy.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.