Critical Privilege Escalation in Microsoft SharePoint Server (CVE‑2023‑29357) Enables Admin Access via Spoofed JWT Tokens
What It Is – Microsoft SharePoint Server contains an authentication bypass flaw that lets an unauthenticated attacker craft spoofed JSON Web Tokens (JWT) and use them to execute a network‑level attack, ultimately gaining administrator privileges.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No public exploit code has been released, but the attack requires only token spoofing, making it highly feasible for skilled adversaries. CVSS v3.1 base score: 9.8 (Critical).
Affected Products – Microsoft SharePoint Server (all supported on‑premises versions prior to the forthcoming security update).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification of authentication mechanisms and token‑validation controls.
- Highlights gaps in privileged‑account monitoring that auditors will scrutinize during security assessments.
- Provides a concrete trigger for organizations to collect and retain evidence of access‑control policy enforcement, supporting a defensible audit trail.
Recommended Actions
- Apply Microsoft’s security update for CVE‑2023‑29357 immediately.
- Review and harden JWT validation logic (signature verification, token lifetime, audience checks).
- Enforce multi‑factor authentication for all privileged SharePoint accounts.
- Deploy real‑time monitoring for anomalous privileged‑account activity and retain logs for audit purposes.
- Update your identity‑access governance documentation to reflect the new control requirement.
Source: CISA KEV – CVE‑2023‑29357