The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has extra a critical security vulnerability impacting Microsoft SharePoint Server to its Acknowledged Exploited Vulnerabilities (KEV) catalog, citing proof of lively exploitation.
The issue, tracked as CVE-2023-29357 (CVSS score: 9.8), is a privilege escalation flaw that could be exploited by an attacker to acquire administrator privileges. Microsoft unveiled patches for the bug as aspect of its June 2023 Patch Tuesday updates.
“An attacker who has acquired entry to spoofed JWT authentication tokens can use them to execute a network attack which bypasses authentication and will allow them to gain entry to the privileges of an authenticated user,” Redmond said. “The attacker needs no privileges nor does the user want to perform any motion.”
Security researcher Nguyễn Tiến Giang (Jang) of StarLabs SG shown an exploit for the flaw at the Pwn2Personal Vancouver hacking contest, earning a $100,000 prize.
The pre-authenticated remote code execution chain brings together authentication bypass (CVE-2023–29357) with a code injection bug (CVE-2023-24955, CVSS score: 7.2), the latter of which was patched by Microsoft in May 2023.
“The method of finding and crafting the exploit chain consumed almost a calendar year of meticulous effort and hard work and study to complete the whole exploit chain,” Tiến Giang famous in a complex report printed in September 2023.
Extra specifics of the genuine-earth exploitation of CVE-2023–29357 and the identification of the danger actors that may be abusing them are presently mysterious. That explained, federal companies are advised to apply the patches by January 31, 2024, to safe versus the energetic threat.
Located this posting interesting? Comply with us on Twitter and LinkedIn to read much more distinctive written content we submit.
Some parts of this article are sourced from:
thehackernews.com
Threat Actors Increasingly Abusing GitHub for Malicious Purposes