Patch or Perish

Old bug, new threat. A patched flaw is now actively exploited, giving attackers full server control. Patch immediately!


From User to Admin

Spoofed tokens unlock the door. Attackers gain admin privileges, stealing data, deploying malware, and causing chaos.


Ransomware on the Radar

Experts suspect ransomware gangs behind the attacks. Back up your data and tighten security to avoid encryption nightmares.

microsoft, ms, logo-80658.jpg

News > Cyber-Attacks > CA-General
by Kevin Wood

Critical Microsoft SharePoint Bug Under Active Attack: A Deep Dive


Major vulnerability in sharepoint

A familiar foe has awakened.

A critical vulnerability in Microsoft SharePoint Server, patched months ago, is now being actively exploited by attackers aiming for complete server takeover. Identified as CVE-2023-29357, this bug carries an alarming 9.8 severity rating, making it a crucial issue demanding immediate attention from organizations utilizing SharePoint.

The Exploit Explained:

This privilege escalation flaw grants attackers administrator privileges on vulnerable servers, essentially handing them the keys to the kingdom. Exploiting this vulnerability involves:

  1. Spoofing JWT Tokens: Attackers craft fake JSON Web Tokens (JWT), the digital keys that authenticate users in SharePoint.
  2. Bypassing Authentication: These spoofed tokens fool the server, granting the attacker temporary access with user-level privileges.
  3. Escalating Privileges: The attacker then leverages this foothold to exploit the vulnerability, elevating their access to full administrator rights.

The Potential Threat:

With administrator privileges, attackers have virtually free reign over a SharePoint server. They can:

  • Steal sensitive data: This includes confidential documents, user credentials, and financial information.
  • Deploy malware: The server can be infected with ransomware, cryptominers, or other malicious software.
  • Disrupt operations: Attackers can disable or manipulate critical functionalities, causing data loss, service outages, and financial damage.

Real-World Examples:

While specific details remain scarce, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of this vulnerability. Researchers also speculate potential connections to ransomware campaigns, highlighting the real-world consequences of neglecting timely patching.

Who’s Behind the Attacks?:

Attributing responsibility for cyberattacks can be challenging, but security experts suspect involvement of various actors, including:

  • Ransomware gangs: Encrypting sensitive data and demanding ransom payments is a lucrative motive for these groups.
  • Nation-state actors: Espionage and disruption could be objectives for government-backed hackers.
  • Cybercriminals: Data theft, financial fraud, and cryptocurrency mining are common goals for general cybercriminals.

Taking Action:

The urgency of mitigating this threat cannot be overstated. Here’s what you can do:

  • Patch Immediately: Apply the security patch released by Microsoft in June 2023 for CVE-2023-29357 without delay.
  • Review Security Practices: Assess and enforce secure authentication practices within your organization.
  • Monitor Activity: Be vigilant for suspicious activity within your SharePoint servers.
  • Backup Data: Regularly back up your data to minimize potential damage from ransomware attacks.

Additional Information:

This critical vulnerability serves as a stark reminder of the importance of proactive cybersecurity measures. Prompt patching, robust security practices, and constant vigilance are key to defending against evolving cyber threats. Don’t let an old foe exploit your systems – act now and safeguard your valuable data.


  • If you’re like a lot of readers and you’re concerned with your organizations cyber security stance
  • Or if you are unsure of your organization’s cyber security stance
  • Reach out to our team today to schedule a meeting and find out how we can help you keep your important data safe from attackers.
  • Email us at today!