Rapid7 Vulnerability & Exploit Database

Sharepoint Dynamic Proxy Generator Unauth RCE

Back to Search

Sharepoint Dynamic Proxy Generator Unauth RCE



This module exploits two vulnerabilities in Sharepoint 2019, an auth bypass CVE-2023-29357 which was patched in June of 2023 and CVE-2023-24955, an RCE which was patched in May of 2023. The auth bypass allows attackers to impersonate the Sharepoint Admin user. This vulnerability stems from the signature validation check used to verify JSON Web Tokens (JWTs) used for OAuth authentication. If the signing algorithm of the user-provided JWT is set to none, SharePoint skips the signature validation step due to a logic flaw in the ReadTokenCore() method. After impersonating the administrator user, the attacker has access to the Sharepoint API and is able to exploit CVE-2023-24955. This authenticated RCE vulnerability leverages the impersonated privileged account to replace the "/BusinessDataMetadataCatalog/BDCMetadata.bdcm" file in the webroot directory with a payload. The payload is then compiled and executed by Sharepoint allowing attackers to remotely execute commands via the API.


  • Jang
  • jheysel-r7






Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > show targets
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > set TARGET < target-id >
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > show options
    ...show and set options...
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security