Identity CVE · OAuth / OIDC / JWT
CVE-2023-29357SharePoint JWT alg:none, impersonate any user
critical · CVSS 9.8CISA KEVActively exploited
Product: Microsoft SharePoint ServerVendor: MicrosoftCWE-347Disclosed: 2023-06-13Status: Actively exploitedProtocol deep diveNVD ↗CISA KEV ↗
What broke
SharePoint Server verified OAuth JWTs in ReadTokenCore(). If the header set alg to none, signature verification was skipped. An unauthenticated attacker minted a token as Administrator. CVSS 9.8. Patched June 2023. STAR Labs chained it with CVE-2023-24955 at Pwn2Own for RCE. CISA added 29357 to KEV in January 2024 after exploitation.
Why it matters
alg:none is a twenty-year-old JWT lesson showing up in a Microsoft product that many enterprises treat as an intranet IdP. The same class returned in SimpleHelp and WordPress OAuth SSO. If your JWT library lets the token pick the algorithm, you are on this list.
What to do
- Patch on-prem SharePoint. If it was reachable after June 2023, review farm-admin and app-principal grants.
- Reject
alg:nonein every verifier you own. See the validate a JWT recipe. - Do not expose SharePoint's OAuth endpoints to the internet.
Sources
- NVD: CVE-2023-29357
- STAR Labs, SharePoint pre-auth RCE chain, September 2023
- CISA KEV
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.