{"id":2352,"date":"2024-01-12T22:32:00","date_gmt":"2024-01-12T22:32:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/cisa-adds-critical-microsoft-sharepoint-bug-kev-catalog"},"modified":"2024-01-12T22:32:00","modified_gmt":"2024-01-12T22:32:00","slug":"cisa-adds-9-8-critical-microsoft-sharepoint-bug-to-its-kev-catalog","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/01\/12\/cisa-adds-9-8-critical-microsoft-sharepoint-bug-to-its-kev-catalog\/","title":{"rendered":"CISA Adds 9.8 ‘Critical’ Microsoft SharePoint Bug to its KEV Catalog"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

On Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) added a privilege escalation vulnerability affecting Microsoft SharePoint servers to its list of Known Exploited Vulnerabilities (KEV).<\/span><\/p>\n

SharePoint is a popular, cloud-based document management and storage system, which is also variously used by companies to implement internal applications and business processes, and share resources via an intranet. As recently as 2020, it enjoyed <\/span>more than 200 million active monthly users<\/a><\/span>.<\/span><\/p>\n

The latest addition to KEV, <\/span>CVE-2023-29357<\/a><\/span>, is a “critical” 9.8 out of 10 vulnerability on the CVSS scale, affecting SharePoint Server 2016 and 2019. With no user engagement required, it allows an attacker to bypass authentication checks and gain administrative access to a server using spoofed JSON Web Token (JWT) authentication tokens.<\/span><\/p>\n

Researchers first demonstrated the utility of CVE-2023-29357 at March 2023’s Pwn2Own event, combining it with a second SharePoint vulnerability to create <\/span>a successful exploit chain<\/a><\/span> \u2014 and <\/span>winning $100,000<\/a><\/span> in the process. Another independent researcher developed <\/span>a proof-of-concept (PoC) exploit<\/a><\/span> in September.<\/span><\/p>\n