CVE-2023-24955

HIGH KEV RANSOMWARE

Microsoft SharePoint Server - Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-24955 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 26, 2024, with confirmed use in ransomware campaigns. EIP tracks 2 public exploits from researchers including former-farmer, Jang, jheysel-r7, including a Metasploit module exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-24955, targeting SharePoint Server 2019. The exploit leverages NTLM authentication and token manipulation to achieve remote code execution (RCE) by injecting malicious code into a memory-based web shell.

Description

Microsoft SharePoint Server Remote Code Execution Vulnerability

Exploits (2)

nomisec WORKING POC 13 stars
by former-farmer · remote-auth
https://github.com/former-farmer/CVE-2023-24955-PoC

This repository contains a functional exploit for CVE-2023-24955, targeting SharePoint Server 2019. The exploit leverages NTLM authentication and token manipulation to achieve remote code execution (RCE) by injecting malicious code into a memory-based web shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft SharePoint Server 2019
Auth required
Prerequisites: Access to a vulnerable SharePoint Server 2019 instance · Valid credentials or ability to bypass authentication
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Jang, jheysel-r7 · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb

This Metasploit module exploits CVE-2023-29357 (auth bypass via JWT 'none' algorithm) and CVE-2023-24955 (RCE via file replacement) in SharePoint 2019. It impersonates the SharePoint admin and executes commands via API.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SharePoint 2019
No auth needed
Prerequisites: Network access to SharePoint server · SharePoint 2019 unpatched for CVE-2023-29357 and CVE-2023-24955
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.9179
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2024-03-26
VulnCheck KEV 2024-03-26
InTheWild.io 2024-03-26
ENISA EUVD EUVD-2023-28942
Ransomware Use Confirmed
CWE
CWE-94
Status published
Products (3)
microsoft/sharepoint_enterprise_server 2016
microsoft/sharepoint_server
microsoft/sharepoint_server 2019
Published May 09, 2023
KEV Added Mar 26, 2024
Tracked Since Feb 18, 2026