Rapid7 Vulnerability & Exploit Database

Sharepoint Dynamic Proxy Generator Unauth RCE

Back to Search

Sharepoint Dynamic Proxy Generator Unauth RCE

Disclosed
05/01/2023
Created
03/26/2024

Description

This module exploits two vulnerabilities in Sharepoint 2019, an auth bypass CVE-2023-29357 which was patched in June of 2023 and CVE-2023-24955, an RCE which was patched in May of 2023. The auth bypass allows attackers to impersonate the Sharepoint Admin user. This vulnerability stems from the signature validation check used to verify JSON Web Tokens (JWTs) used for OAuth authentication. If the signing algorithm of the user-provided JWT is set to none, SharePoint skips the signature validation step due to a logic flaw in the ReadTokenCore() method. After impersonating the administrator user, the attacker has access to the Sharepoint API and is able to exploit CVE-2023-24955. This authenticated RCE vulnerability leverages the impersonated privileged account to replace the "/BusinessDataMetadataCatalog/BDCMetadata.bdcm" file in the webroot directory with a payload. The payload is then compiled and executed by Sharepoint allowing attackers to remotely execute commands via the API.

Author(s)

  • Jang
  • jheysel-r7

Platform

Windows

Architectures

cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > show targets
    ...targets...
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > set TARGET < target-id >
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > show options
    ...show and set options...
msf exploit(sharepoint_dynamic_proxy_generator_auth_bypass_rce) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;