SharePoint CVE-2023-24955 + 29357: Pwn2Own Chain Exploited

What to do

1. Run (Get-SPFarm).BuildVersion in the SharePoint Management Shell on every farm and compare it with the current monthly build, not just the 2023 fixed builds.
2. Install the latest SharePoint security updates on every server in the farm, then run the configuration wizard so the farm build actually advances.
3. Take SharePoint off the open internet or put it behind a VPN or an authenticating reverse proxy.
4. Enable AMSI integration with Microsoft Defender or an equivalent; Microsoft lists it as a mitigating factor for CVE-2023-29357.
5. If a farm was internet-facing and below the June 2023 build in late 2023 or 2024, run the hunt below before treating it as clean.
6. Plan the move off SharePoint Server 2016 and 2019, whose extended support ended in July 2026.

How to check if you are affected or compromised

• Compare farm build numbers against 16.0.5395.1000 (2016), 16.0.10399.20005 (2019) and 16.0.16130.20420 (Subscription Edition); anything older was exposed to the chain.
• Review IIS logs for REST API (/_api/) calls from unfamiliar external addresses that enumerate users or site admins, especially from late September 2023 onward when public exploit code appeared.
• Look for new or changed .aspx files under the SharePoint TEMPLATE\LAYOUTS directory and for w3wp.exe spawning cmd.exe or powershell.exe.
• Audit site collection administrators and Site Owner group membership for accounts nobody can explain.

What happened#

At Pwn2Own Vancouver in March 2023, STAR Labs researcher Nguyễn Tiến Giang (Jang) took over a SharePoint Server with a two-bug chain and won $100,000. Microsoft fixed the second bug first. CVE-2023-24955, a code injection flaw (CWE-94), shipped in the May 9, 2023 updates. Microsoft scores it CVSS 3.1 7.2 and says "an authenticated attacker as a Site Owner could execute code remotely" on the server. The first bug, CVE-2023-29357, was fixed on June 13, 2023. It is a 9.8 authentication bypass: an attacker with spoofed JWT authentication tokens can gain the privileges of an authenticated user, including administrator, with no credentials and no user interaction.

Chained, the two give unauthenticated remote code execution. STAR Labs published its write-up on September 25, 2023, and a proof of concept for CVE-2023-29357 appeared on GitHub the next day, according to Tenable. That first PoC stopped short of code execution, but BleepingComputer reported that other exploits for the chain followed. CISA added CVE-2023-29357 to KEV on January 10, 2024, and CVE-2023-24955 on March 26, 2024, with an April 16 deadline. Both entries now say "Known" for ransomware use. CISA has not published details of the attacks, as SecurityWeek noted at the time.

Who is affected#

On-premises SharePoint only. The CVE record lists SharePoint Enterprise Server 2016 before 16.0.5395.1000, SharePoint Server 2019 before 16.0.10398.20000, and Subscription Edition before 16.0.16130.20420. The CVE-2023-29357 record lists only SharePoint Server 2019, fixed in 16.0.10399.20005. SharePoint Online is not affected.

Do you really need to act?#

Most farms got these fixes in 2023, so the verdict today is check exposure. Two caveats matter. First, a farm old enough to lack these fixes is also missing fixes for later exploited SharePoint bugs, including CVE-2024-38094, the ToolShell chain (CVE-2025-53770) and the 2026 zero-day CVE-2026-56164. Patching to a 2023 build is not enough. Second, exploitation was confirmed for months in early 2024. A farm that was internet-facing and unpatched then may hold a web shell that a later update did not remove. Microsoft's lifecycle pages also list July 2026 as the end of extended support for SharePoint Server 2016 and 2019.

What to do now#

1. On each farm, open the SharePoint Management Shell and run (Get-SPFarm).BuildVersion. Compare it with the current monthly build.
2. Install the latest SharePoint security updates on every server, then run the SharePoint Products Configuration Wizard.
3. Remove direct internet exposure, or front the farm with a VPN or an authenticating proxy.
4. Turn on AMSI integration with Microsoft Defender. Microsoft lists it as a mitigating factor for CVE-2023-29357.
5. Plan the upgrade from 2016 or 2019 to Subscription Edition.

How to tell if you were hit#

• Check whether the build was below 16.0.10399.20005 (2019), 16.0.5395.1000 (2016) or 16.0.16130.20420 (Subscription Edition) while the farm was reachable, especially after September 2023.
• Review IIS logs for /_api/ requests from unfamiliar addresses that enumerate users or site admins.
• Look for new .aspx files under the TEMPLATE\LAYOUTS directory and for w3wp.exe launching cmd.exe or powershell.exe.
• Audit site collection administrators and Site Owners for accounts nobody can explain.

Timeline#

• Mar 2023 — STAR Labs demonstrates the chain at Pwn2Own Vancouver.
• May 9, 2023 — Microsoft fixes CVE-2023-24955.
• Jun 13, 2023 — Microsoft fixes CVE-2023-29357.
• Sep 25, 2023 — STAR Labs publishes its write-up; a PoC follows the next day.
• Jan 10, 2024 — CISA adds CVE-2023-29357 to KEV.
• Mar 26, 2024 — CISA adds CVE-2023-24955 to KEV.
• Jul 14, 2026 — Extended support for SharePoint Server 2016 and 2019 ends.

Vulnerability records

• CVE-2023-24955 · KEV 2024-03-26 · Microsoft SharePoint Server Remote Code Execution Vulnerability
• CVE-2023-29357 · KEV 2024-01-10 · Microsoft SharePoint Server Elevation of Privilege Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — CVE-2023-24955: Microsoft SharePoint Server Remote Code Execution Vulnerability msrc.microsoft.com
2. Microsoft — CVE-2023-29357: Microsoft SharePoint Server Elevation of Privilege Vulnerability msrc.microsoft.com
3. CVE record — CVE-2023-24955 cve.org
4. CVE record — CVE-2023-29357 cve.org
5. NVD — CVE-2023-24955 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2023-24955 cisa.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2023-29357 cisa.gov
8. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Mar 26, 2024) cisa.gov
9. Microsoft Learn — SharePoint Server 2019 lifecycle learn.microsoft.com
10. Microsoft Learn — SharePoint Server 2016 lifecycle learn.microsoft.com
11. Tenable — CVE-2023-29357, CVE-2023-24955: Exploit Chain Released for Microsoft SharePoint Server Vulnerabilities tenable.com

Coverage and analysis

1. BleepingComputer — CISA: Critical Microsoft SharePoint bug now actively exploited bleepingcomputer.com
2. SecurityWeek — CISA: Second SharePoint Flaw Disclosed at Pwn2Own Exploited in Attacks securityweek.com