CVE-2023-21742

published 2023-01-10

CVE-2023-21742: Microsoft SharePoint Server Remote Code Execution Vulnerability

Priority P1 84 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

Microsoft SharePoint Server Remote Code Execution Vulnerability

Affected

14 ranges

Vendor	Product	Version range	Fixed in
microsoft	microsoft_sharepoint_enterprise_server_2013_service_pack_1	>= 15.0.0 < 15.0.5519.1000	15.0.5519.1000
microsoft	microsoft_sharepoint_enterprise_server_2016	>= 16.0.0 < 16.0.5378.1000	16.0.5378.1000
microsoft	microsoft_sharepoint_foundation_2013_service_pack_1	>= 15.0.0 < 15.0.5519.1000	15.0.5519.1000
microsoft	microsoft_sharepoint_server_2019	>= 16.0.0 < 16.0.10394.20021	16.0.10394.20021
microsoft	microsoft_sharepoint_server_subscription_edition	>= 16.0.0 < 16.0.15601.20418	16.0.15601.20418
microsoft	sharepoint_foundation	—	—
microsoft	sharepoint_server	—	—
microsoft	sharepoint_server	—	—
microsoft	sharepoint_server	—	—
msrc	microsoft_sharepoint_enterprise_server_2013_service_pack_1	—	—
msrc	microsoft_sharepoint_enterprise_server_2016	—	—
msrc	microsoft_sharepoint_foundation_2013_service_pack_1	—	—
msrc	microsoft_sharepoint_server_2019	—	—
msrc	microsoft_sharepoint_server_subscription_edition	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /webpartpages.asmx

command ConvertWebPartFormat

bytes

SelectUrl=" (SelectUrl|3d 22|)

snort

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Sharepoint WebPartPagesWebService Authenticated Remote Code Execution (CVE-2023-21742)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webpartpages.asmx"; http.request_body; content:"ConvertWebPartFormat"; fast_pattern; content:"SelectUrl|3d 22|"; pcre:"/^[a-z]+\x3a\x2f{2}/R"; reference:url,github.com/ohnonoyesyes/CVE-2023-21742; classtype:attempted-user; sid:2063365; rev:1; metadata:affected_product Microsoft_Sharepoint, attack_target Server, created_at 2025_07_09, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit traffic uses HTTP POST method targeting the SharePoint WebPartPagesWebService endpoint at /webpartpages.asmx
• → The exploit request body contains the SOAP action 'ConvertWebPartFormat' as a fast-pattern anchor for detection
• → The exploit embeds a URL value in the SelectUrl parameter (URL-encoded '=' as 0x3d followed by '"' 0x22); a PCRE match on a scheme prefix (e.g. http://) immediately following confirms a crafted URL injection
• → Attacker must be authenticated as at minimum a Site Member (PR:L); unauthenticated traffic to this endpoint is not indicative of this CVE ↗
• → Attack vector is network-based; monitor inbound POST requests to SharePoint's .asmx web service endpoints from authenticated low-privilege users ↗

• · The Snort/ET rule is directional to $HOME_NET (inbound to server); ensure $HOME_NET is correctly scoped to include SharePoint server IPs for accurate detection coverage
• · The rule is recommended for both Perimeter and Internal deployment, meaning it should be applied at network edge AND on internal segments to catch lateral movement exploitation

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vulncheck 8.8 HIGH

vendor_msrc 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284