Microsoft SharePoint Server CVE-2023-29357 (elevation of privilege via spoofed JWT tokens, CISA KEV, used in ransomware): which updates fix it and how do I check my farm?

What it is: CVE-2023-29357 is an elevation-of-privilege flaw in Microsoft SharePoint Server, patched in Microsoft's June 2023 updates. CISA describes it as letting an unauthenticated attacker who holds spoofed JWT authentication tokens bypass authentication and obtain administrator privileges over the network. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2024-01-10 and flags it as used in ransomware campaigns, so unpatched SharePoint farms that are reachable from untrusted networks are at real risk. Am I affected: - Microsoft's update guide lists SharePoint Server 2019 as the affected product, and NVD's configuration data matches that. Confirm the status of any other SharePoint version in the MSRC entry for your edition. - Check the farm build in Central Administration > Upgrade and Migration > Check product and patch installation status, or with Get-SPFarm | Select BuildVersion in the SharePoint Management Shell. For SharePoint 2019 the June 2023 security updates bring the build to 16.0.10399.20005, so anything lower has not received them. Fix: 1. Install the June 2023 SharePoint Server 2019 security updates (KB5002402 for the main package and KB5002403 for the language-independent package), then run the SharePoint Products Configuration Wizard / PSConfig on every server so the databases are upgraded. Better still, move to the latest cumulative security update available for your edition, which also covers later critical SharePoint bugs. 2. Microsoft notes that farms with AMSI integration enabled and Microsoft Defender on the SharePoint servers are protected from this issue. Treat that as defense in depth, not a replacement for patching. 3. Do not expose SharePoint administration or the farm to the internet unless it is required; place it behind a reverse proxy/VPN with authentication and logging. 4. If the farm was unpatched and internet-facing, assume it may be compromised: review IIS and SharePoint logs for unexpected administrator activity, new or changed farm administrators and site collection admins, unexpected files under the SharePoint layouts and web application directories, and new scheduled tasks or services. Rebuild from known-good media if anything suspicious is found, and rotate the farm passphrase, service account passwords, the machine keys, and any credentials or API secrets stored in SharePoint. Verify: Get-SPFarm shows a build at or above the fixed build on every server, PSConfig completed without errors, and the Check product and patch installation status page shows no servers in a "needs upgrade" state. Sources: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357 https://nvd.nist.gov/vuln/detail/CVE-2023-29357 https://www.cisa.gov/known-exploited-vulnerabilities-catalog