---
title: "SharePoint CVE-2023-24955 + 29357: Pwn2Own Chain Exploited"
url: https://erroneo.us/security/briefs/sharepoint-cve-2023-24955-29357-pwn2own-chain/
description: "A 2023 SharePoint Server code-injection bug and a JWT auth bypass chain into unauthenticated RCE; both in KEV with ransomware use. Check builds and hunt."
type: security-brief
section: "Security Digest"
date_published: 2023-05-09
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-24955", "CVE-2023-29357"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SharePoint CVE-2023-24955 + 29357: Pwn2Own Chain Exploited

**Verdict: Check exposure.** Patched in May and June 2023 and long superseded; the real question is whether any on-prem farm still runs a pre-2023 build or was exposed and unpatched in early 2024, when exploitation was confirmed.

- **Who must act:** Owners of on-premises SharePoint Server 2016, 2019 or Subscription Edition farms that are internet-facing and not on current cumulative updates, or that missed the May and June 2023 updates for any period.
- **Who can relax:** SharePoint Online (Microsoft 365) customers, and on-prem farms that install SharePoint security updates every month and are not reachable from the internet.
- **Affected:** SharePoint Enterprise Server 2016 before 16.0.5395.1000 (CVE-2023-24955); SharePoint Server 2019 before 16.0.10398.20000 (CVE-2023-24955) and before 16.0.10399.20005 (CVE-2023-29357); SharePoint Server Subscription Edition before 16.0.16130.20420 (CVE-2023-24955)
- **Fixed:** May 9, 2023 updates: KB5002397 (2016, 16.0.5395.1000), KB5002389 (2019, 16.0.10398.20000), KB5002390 (Subscription Edition, 16.0.16130.20420); June 13, 2023 updates for SharePoint Server 2019: KB5002402 and KB5002403 (16.0.10399.20005); Current cumulative updates, which are needed anyway for later exploited SharePoint bugs
- **CVEs:** CVE-2023-24955, CVE-2023-29357
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run (Get-SPFarm).BuildVersion in the SharePoint Management Shell on every farm and compare it with the current monthly build, not just the 2023 fixed builds.
2. Install the latest SharePoint security updates on every server in the farm, then run the configuration wizard so the farm build actually advances.
3. Take SharePoint off the open internet or put it behind a VPN or an authenticating reverse proxy.
4. Enable AMSI integration with Microsoft Defender or an equivalent; Microsoft lists it as a mitigating factor for CVE-2023-29357.
5. If a farm was internet-facing and below the June 2023 build in late 2023 or 2024, run the hunt below before treating it as clean.
6. Plan the move off SharePoint Server 2016 and 2019, whose extended support ended in July 2026.

### How to check if you are affected

- Compare farm build numbers against 16.0.5395.1000 (2016), 16.0.10399.20005 (2019) and 16.0.16130.20420 (Subscription Edition); anything older was exposed to the chain.
- Review IIS logs for REST API (/_api/) calls from unfamiliar external addresses that enumerate users or site admins, especially from late September 2023 onward when public exploit code appeared.
- Look for new or changed .aspx files under the SharePoint TEMPLATE\LAYOUTS directory and for w3wp.exe spawning cmd.exe or powershell.exe.
- Audit site collection administrators and Site Owner group membership for accounts nobody can explain.

## What happened

At Pwn2Own Vancouver in March 2023, STAR Labs researcher Nguyễn Tiến Giang (Jang) took over a SharePoint Server with a two-bug chain and won $100,000. Microsoft fixed the second bug first. [CVE-2023-24955](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955), a code injection flaw (CWE-94), shipped in the May 9, 2023 updates. Microsoft scores it CVSS 3.1 7.2 and says "an authenticated attacker as a Site Owner could execute code remotely" on the server. The first bug, [CVE-2023-29357](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357), was fixed on June 13, 2023. It is a 9.8 authentication bypass: an attacker with spoofed JWT authentication tokens can gain the privileges of an authenticated user, including administrator, with no credentials and no user interaction.

Chained, the two give unauthenticated remote code execution. STAR Labs published its write-up on September 25, 2023, and a proof of concept for CVE-2023-29357 appeared on GitHub the next day, according to [Tenable](https://www.tenable.com/blog/cve-2023-29357-cve-2023-24955-exploit-chain-released-for-microsoft-sharepoint-server). That first PoC stopped short of code execution, but [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-critical-microsoft-sharepoint-bug-now-actively-exploited/) reported that other exploits for the chain followed. CISA added [CVE-2023-29357 to KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29357) on January 10, 2024, and [CVE-2023-24955](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24955) on [March 26, 2024](https://www.cisa.gov/news-events/alerts/2024/03/26/cisa-adds-one-known-exploited-vulnerability-catalog), with an April 16 deadline. Both entries now say "Known" for ransomware use. CISA has not published details of the attacks, as [SecurityWeek](https://www.securityweek.com/cisa-second-sharepoint-flaw-disclosed-at-pwn2own-exploited-in-attacks/) noted at the time.

## Who is affected

On-premises SharePoint only. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-24955) lists SharePoint Enterprise Server 2016 before 16.0.5395.1000, SharePoint Server 2019 before 16.0.10398.20000, and Subscription Edition before 16.0.16130.20420. The [CVE-2023-29357 record](https://www.cve.org/CVERecord?id=CVE-2023-29357) lists only SharePoint Server 2019, fixed in 16.0.10399.20005. SharePoint Online is not affected.

## Do you really need to act?

Most farms got these fixes in 2023, so the verdict today is check exposure. Two caveats matter. First, a farm old enough to lack these fixes is also missing fixes for later exploited SharePoint bugs, including CVE-2024-38094, the ToolShell chain (CVE-2025-53770) and the 2026 zero-day CVE-2026-56164. Patching to a 2023 build is not enough. Second, exploitation was confirmed for months in early 2024. A farm that was internet-facing and unpatched then may hold a web shell that a later update did not remove. Microsoft's lifecycle pages also list July 2026 as the end of extended support for [SharePoint Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2016) and [2019](https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2019).

## What to do now

1. On each farm, open the SharePoint Management Shell and run `(Get-SPFarm).BuildVersion`. Compare it with the current monthly build.
2. Install the latest SharePoint security updates on every server, then run the SharePoint Products Configuration Wizard.
3. Remove direct internet exposure, or front the farm with a VPN or an authenticating proxy.
4. Turn on AMSI integration with Microsoft Defender. Microsoft lists it as a mitigating factor for CVE-2023-29357.
5. Plan the upgrade from 2016 or 2019 to Subscription Edition.

## How to tell if you were hit

- Check whether the build was below 16.0.10399.20005 (2019), 16.0.5395.1000 (2016) or 16.0.16130.20420 (Subscription Edition) while the farm was reachable, especially after September 2023.
- Review IIS logs for `/_api/` requests from unfamiliar addresses that enumerate users or site admins.
- Look for new `.aspx` files under the `TEMPLATE\LAYOUTS` directory and for `w3wp.exe` launching `cmd.exe` or `powershell.exe`.
- Audit site collection administrators and Site Owners for accounts nobody can explain.

## Timeline

- Mar 2023 — STAR Labs demonstrates the chain at Pwn2Own Vancouver.
- May 9, 2023 — Microsoft fixes CVE-2023-24955.
- Jun 13, 2023 — Microsoft fixes CVE-2023-29357.
- Sep 25, 2023 — STAR Labs publishes its write-up; a PoC follows the next day.
- Jan 10, 2024 — CISA adds CVE-2023-29357 to KEV.
- Mar 26, 2024 — CISA adds CVE-2023-24955 to KEV.
- Jul 14, 2026 — Extended support for SharePoint Server 2016 and 2019 ends.

## Sources

1. [Microsoft — CVE-2023-24955: Microsoft SharePoint Server Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955)
2. [Microsoft — CVE-2023-29357: Microsoft SharePoint Server Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357)
3. [CVE record — CVE-2023-24955](https://www.cve.org/CVERecord?id=CVE-2023-24955)
4. [CVE record — CVE-2023-29357](https://www.cve.org/CVERecord?id=CVE-2023-29357)
5. [NVD — CVE-2023-24955](https://nvd.nist.gov/vuln/detail/CVE-2023-24955)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-24955](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24955)
7. [CISA — Known Exploited Vulnerabilities: CVE-2023-29357](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29357)
8. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Mar 26, 2024)](https://www.cisa.gov/news-events/alerts/2024/03/26/cisa-adds-one-known-exploited-vulnerability-catalog)
9. [Microsoft Learn — SharePoint Server 2019 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2019)
10. [Microsoft Learn — SharePoint Server 2016 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2016)
11. [Tenable — CVE-2023-29357, CVE-2023-24955: Exploit Chain Released for Microsoft SharePoint Server Vulnerabilities](https://www.tenable.com/blog/cve-2023-29357-cve-2023-24955-exploit-chain-released-for-microsoft-sharepoint-server)
12. [BleepingComputer — CISA: Critical Microsoft SharePoint bug now actively exploited](https://www.bleepingcomputer.com/news/security/cisa-critical-microsoft-sharepoint-bug-now-actively-exploited/)
13. [SecurityWeek — CISA: Second SharePoint Flaw Disclosed at Pwn2Own Exploited in Attacks](https://www.securityweek.com/cisa-second-sharepoint-flaw-disclosed-at-pwn2own-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/sharepoint-cve-2023-24955-29357-pwn2own-chain/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt