CVE-2023-24955

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description An issue exists due to insufficient input validation, allowing a remote attacker to perform code injection and execute arbitrary code. The flaw is specifically linked to the GenerateProxyAssembly function and the ability to overwrite the /BusinessDataMetadataCatalog/BDCMetadata.bdcm file in the root directory, which is subsequently executed by the server. Successful exploitation can grant the attacker control over the server to access private information and maintain persistence. This issue can be combined with other flaws to bypass authentication and utilize the SharePoint API with administrator privileges. There are over 372,000 potentially affected devices worldwide, and the flaw has been exploited in real-world attacks.

Recommendations Apply the security updates released in May 2023 for Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server.