Loading vulnerability…
CVE-2023-24955 is a code injection vulnerability in Microsoft SharePoint Server that allows remote code execution by an authenticated attacker who has SharePoint Site Owner privileges. The flaw was described as affecting SharePoint Server and enabling a Site Owner to execute code on the underlying affected server. Public reporting also documented that this vulnerability can be chained with CVE-2023-29357, an authentication bypass and privilege-escalation issue involving spoofed JWT tokens, to convert the originally authenticated attack path into unauthenticated remote code execution. The vulnerability was patched by Microsoft in May 2023 and has been listed as exploited in the wild, including use associated with ransomware activity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module targeting Microsoft SharePoint Server 2019, specifically exploiting a pre-authentication chain involving CVE-2023-29357 (authentication bypass) and CVE-2023-24955 (remote code execution). The exploit works by first bypassing authentication via a flaw in JWT signature validation, allowing the attacker to impersonate the SharePoint admin. With admin privileges, the module then abuses the SharePoint API to replace the BDCMetadata.bdcm file with a payload, which is subsequently executed by the server, resulting in arbitrary command execution. The module is weaponized, supporting customizable payloads (defaulting to a Meterpreter reverse shell) and includes logic to restore the original file after exploitation. The main attack vector is network-based, targeting the SharePoint HTTP(S) interface. The code is written in Ruby and is structured as a standard Metasploit exploit module, with clear separation of authentication bypass, payload delivery, and cleanup routines. No hardcoded IPs or external domains are present; all endpoints are relative to the target SharePoint server.
This repository contains a Python 2 exploit script (CVE-2023-24955.py) and a README.md. The exploit targets Microsoft SharePoint 2019 servers vulnerable to CVE-2023-24955, a remote code execution vulnerability. The script performs several steps: it authenticates to the SharePoint server using NTLM, manipulates SharePoint's Business Data Connectivity Metadata (BDCM), and uploads a malicious .aspx web shell to a path under /_vti_bin/DelveApi.ashx/gift_from_starlabs/. The web shell allows the attacker to execute arbitrary commands on the server. The script requires Python 2 and logs its activity to debug.log. The README provides usage instructions and notes that the script is a fixed version of a previously published PoC. The exploit is operational, providing a working web shell if the target is vulnerable. No framework is used; the code is standalone.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.