CVE-2023-29357

[buixor]

Add vpatch rule for CVE-2023-29357 — Microsoft SharePoint Authentication Bypass
Adds a virtual-patch AppSec rule and associated test assets for CVE-2023-29357, a critical (CVSS 9.8) authentication bypass in Microsoft SharePoint Server exploited by forging JWT tokens using the none signing algorithm to impersonate administrator sessions via the SharePoint REST API. This CVE is KEV-listed, actively used in ransomware campaigns, and chains with CVE-2023-24955 to achieve unauthenticated RCE. Over 150,000 SharePoint instances are exposed on the internet.
Detection logic: matches GET requests to /_api/ endpoints where the Authorization header contains the hashedprooftoken claim — a field injected by the exploit's forged JWT that does not appear in any legitimate SharePoint token.

[github-actions]

Hello @buixor,

✅ The new VPATCH Rule is compliant, thank you for your contribution!

[github-actions]

Hello @buixor and thank you for your contribution!

I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information.
I've found some errors in your scenarios, please fix them and re-submit your PR, or ask for help if you need it.

The following items have errors:

crowdsecurity/crs-exclusion-plugin-cpanel:

• labels not found

crowdsecurity/crs-exclusion-plugin-dokuwiki:

• labels not found

crowdsecurity/crs-exclusion-plugin-drupal:

• labels not found

crowdsecurity/crs-exclusion-plugin-nextcloud:

• labels not found

crowdsecurity/crs-exclusion-plugin-phpbb:

• labels not found

crowdsecurity/crs-exclusion-plugin-phpmyadmin:

• labels not found

crowdsecurity/crs-exclusion-plugin-wordpress:

• labels not found

crowdsecurity/crs-exclusion-plugin-xenforo:

• labels not found

Mitre ATT&CK

Information about mitre attack can be found here.
As an example, some common mitre attack techniques:

• T1110 for bruteforce attacks
• T1595 and T1190 for exploitation of public vulnerabilities
• T1595 for generic scanning of exposed applications

Expected format is (where XXXX is the technique ID):

labels:
  classification:
    - attack.TXXXX

CVEs

If your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it.

Expected format is (where CVE-XXX-XXX is the CVE ID):

labels:
  classification:
    - cve.CVE-XXX-XXX

Behaviors

Please identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here.

Expected format is (where <behavior> is the behavior you want to target):

labels:
  behavior: <behavior>

See the labels documentation for more information.