CISA tags Microsoft SharePoint RCE bug as actively exploited

CISA warns that attackers are now exploiting a Microsoft SharePoint code injection vulnerability that can be chained with a critical privilege escalation flaw for pre-auth remote code execution attacks. Tracked as CVE-2023-24955, this SharePoint Server vulnerability enables authenticated attackers with Site Owner privileges to execute code remotely on vulnerable servers. The second flaw (CVE-2023-29357) allows remote attackers to gain admin privileges on vulnerable SharePoint servers by circumventing authentication using spoofed JWT auth tokens. These two SharePoint Server security vulnerabilities can be chained by unauthenticated attackers to gain RCE on unpatched servers, as STAR Labs researcher Nguyễn Tiến Giang (Janggggg) demonstrated during last year's March 2023 Pwn2Own contest in Vancouver. A CVE-2023-29357 proof-of-concept exploit was released on GitHub on September 25, one day after the security researcher published a technical analysis describing the exploitation process. Although the PoC exploit did not allow attackers to gain remote code execution on targeted systems, threat actors could still modify it to complete the chain with CVE-2023-24955 exploitation capabilities for RCE attacks. Multiple PoC exploits targeting this chain have since surfaced online (including one released by Star Labs), making it easier for less skilled attackers to use it in their attacks. One month later, CISA added the CVE-2023-29357 flaw to its Known Exploited Vulnerabilities Catalog a...