How to Fix CVE-2023-24955: Improper Control of Generation of Code ('Code Injection')

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2024-03-26, federal due date 2024-04-16.

What is CVE-2023-24955?

CVE-2023-24955 is a remote code execution vulnerability in Microsoft SharePoint Server, the on-premises collaboration and document-management platform that runs on Windows Server with IIS and SQL Server behind it. Microsoft published it on 9 May 2023 as part of that month's Patch Tuesday. The classification is CWE-94, Improper Control of Generation of Code ('Code Injection'): an authenticated attacker can inject a server-side payload that SharePoint then compiles and executes as its own code.

The flaw lives in the way SharePoint deserializes and processes certain user-controlled content. An attacker who holds a SharePoint account with Site Owner permissions (or higher) on a target site can craft input that SharePoint turns into executable code on the server. The CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2, captures this exactly: it is network-reachable (AV:N) and needs no user interaction (UI:N), but it requires high privileges (PR:H), which is why the score sits at 7.2 rather than near 9. Once the condition is met, the impact is total: full confidentiality, integrity, and availability loss on the SharePoint server.

This is a code-injection bug, not a memory-corruption bug. There is no buffer overflow or use-after-free to wrangle. The attacker supplies content the application is supposed to treat as data, and the application instead generates and runs code from it. That makes the exploit reliable and not dependent on heap grooming or ASLR bypasses, which is one reason it became attractive to attackers.

Why this CVE matters

On its own, the high-privilege requirement (PR:H) makes CVE-2023-24955 look like an insider-only problem. In practice it became dangerous because it was chained. At Pwn2Own Vancouver 2023, a STAR Labs researcher combined CVE-2023-24955 with CVE-2023-29357, a SharePoint privilege-escalation/authentication-bypass flaw, to go from unauthenticated network access all the way to remote code execution. CVE-2023-29357 hands the attacker the elevated SharePoint identity; CVE-2023-24955 then turns that identity into code execution. Patch one without the other and the chain may still partially function, so SharePoint admins should treat both as a pair.

CISA added CVE-2023-24955 to the Known Exploited Vulnerabilities catalog on 26 March 2024, with a federal remediation deadline of 16 April 2024. CISA's SSVC decision data marks exploitation as active and technical impact as total. A SharePoint farm is rarely a throwaway box: it holds documents, intranet content, business workflows, and frequently service accounts with reach into Active Directory and SQL Server. Code execution as the SharePoint service identity is a strong pivot point into the rest of a Windows estate. If your farm was reachable and unpatched after the chain went public, treat the exposure window as compromise-likely.

Am I affected? Check your SharePoint build

SharePoint Server is Windows-only software; there are no Linux packages, Debian repos, or container images to check. Identify your edition and build number from the SharePoint Management Shell on a farm server, then compare against the fixed builds below.

# Run on a SharePoint server, as a farm administrator, in the
# SharePoint Management Shell (it loads the Microsoft.SharePoint.PowerShell snap-in).
Get-SPFarm | Select-Object BuildVersion

# Per-product / per-patch detail (shows which security updates are installed):
Get-SPProduct | Select-Object ProductName, @{N='Patches';E={$_.PatchableUnitDisplayNames}}

# Or read the version from the registry without the snap-in:
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office Server\16.0' -Name BuildVersion -ErrorAction SilentlyContinue

Match the reported build against the affected ranges:

• SharePoint Enterprise Server 2016. vulnerable below 16.0.5395.1000; fixed at 16.0.5395.1000 and later.
• SharePoint Server 2019, vulnerable below 16.0.10398.20000; fixed at 16.0.10398.20000 and later.
• SharePoint Server Subscription Edition: vulnerable below 16.0.16130.20420; fixed at 16.0.16130.20420 and later.

SharePoint Server 2013 reached end of support on 11 April 2023 and is not listed in this advisory. If you still run 2013, it will not receive this fix and you should migrate or isolate it.

How to fix CVE-2023-24955

The fix is the May 2023 SharePoint security update for your edition, distributed through the Microsoft Update Catalog, Windows Update, and WSUS. SharePoint updates ship as two parts you typically need to apply together, the language-independent (STS / server) package and the language-dependent (WSS / language pack) package. followed by the configuration step that upgrades the databases. Skipping the configuration step leaves the farm in an "upgrade required" state even though the binaries are patched.

Step 1, Get the correct update for your edition

Open the MSRC advisory for CVE-2023-24955 and follow the link to the KB and Update Catalog package that matches your edition (2016, 2019, or Subscription Edition). Do not guess a KB number; the advisory lists the exact build and the packages required to reach it.

# Vendor advisory (authoritative source for the exact KB and build):
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955

# Confirm the current build before you start, so you can prove the change afterward.
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
(Get-SPFarm).BuildVersion

Step 2: Install the update on every farm server

Run the downloaded .exe patch packages on every server in the farm (WFE, application, and search servers) before running configuration. Install them one server at a time; reboot if prompted. The binaries can be staged without taking the whole farm down, but the database upgrade in Step 3 is the part that needs a maintenance window.

# Run as administrator on each farm server. Example for a downloaded package:
Start-Process -FilePath 'C:\Patches\sts2019-kb_xxxxxxx-fullfile-x64-glb.exe' `
    -ArgumentList '/quiet','/norestart' -Wait
Start-Process -FilePath 'C:\Patches\wssloc2019-kb_xxxxxxx-fullfile-x64-glb.exe' `
    -ArgumentList '/quiet','/norestart' -Wait
# Replace the file names with the actual packages linked from the MSRC advisory.

Step 3, Upgrade the farm (PSConfig)

After the binaries are on every server, run the configuration step on each server so the content and configuration databases are upgraded to the patched schema. Use the command line rather than the GUI wizard for repeatability:

# Run on each server, app/central-admin servers last is a safe order.
# & "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\16\BIN\psconfig.exe" `
#   -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures
$psconfig = Join-Path $env:CommonProgramFiles `
    'Microsoft Shared\Web Server Extensions\16\BIN\PSConfig.exe'
& $psconfig -cmd upgrade -inplace b2b -wait `
    -cmd applicationcontent -install -cmd installfeatures

Step 4. Verify the build moved past the fixed threshold

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
$build = (Get-SPFarm).BuildVersion
"$build"

# Confirm there is no pending upgrade on any server:
Get-SPProduct -Local | Select-Object ProductName, InstallStatus

# 2016 must be >= 16.0.5395.1000
# 2019 must be >= 16.0.10398.20000
# Subscription Edition must be >= 16.0.16130.20420

If Get-SPProduct reports any server as needing an upgrade, the patch binaries are present but PSConfig has not finished on that node. The farm is not fully remediated until every server reports a clean status and the build version is at or above the fixed threshold for your edition.

If you can't patch immediately

Patching is the only durable fix. These mitigations narrow the attack surface while you schedule the change window; they do not remove the vulnerability, and because this CVE is exploitable by an authenticated user, network filtering alone does not close it.

• Restrict who holds elevated SharePoint permissions. The exploit needs Site Owner or higher. Audit site collection administrators and Owner groups and remove anyone who does not need that level. Fewer privileged accounts means fewer accounts an attacker can hijack to reach the bug.
• Patch CVE-2023-29357 first if it is outstanding. That auth-bypass flaw is what lets an unauthenticated attacker reach the privilege level this RCE requires. Closing it breaks the public exploit chain even before you apply this update.
• Reduce internet exposure. If the farm does not need to be public, put it behind the VPN or a reverse proxy that enforces authentication, and scope inbound 443 to known networks at the firewall.
• Watch the SharePoint and IIS logs. Look for unexpected requests to _layouts and ToolPane / API endpoints, new processes spawned by the IIS application pool identity (w3wp.exe), and outbound connections from the SharePoint servers.

Confirm and clean up

After the build version shows the patched release on every server, run an authenticated vulnerability scan with a current signature set and confirm it no longer flags CVE-2023-24955. Because this CVE is on the CISA KEV list and was part of a public Pwn2Own chain, treat any farm that was reachable and unpatched after disclosure as potentially touched: review IIS and SharePoint ULS logs over the full exposure window, check for unfamiliar web shells under the SharePoint web application directories, and rotate the credentials of the SharePoint farm and service accounts the worker process could read. Pair this work with the fix for CVE-2023-29357 so the chain is closed end to end.

Frequently asked questions

Does CVE-2023-24955 affect SharePoint Online / Microsoft 365?

No. This advisory covers on-premises SharePoint Server only, Enterprise Server 2016, Server 2019, and Subscription Edition. SharePoint Online in Microsoft 365 is maintained by Microsoft and is not part of this CVE.

Why is the CVSS only 7.2 if it is remote code execution?

The vector includes PR:H: the attacker needs an account with Site Owner or higher permissions before they can trigger it. That privilege requirement caps the score at 7.2. The real-world risk is higher than the number suggests because the bug is chained with CVE-2023-29357, an authentication bypass that supplies those privileges to an unauthenticated attacker.

Do I need to patch CVE-2023-29357 as well?

Yes, if it is still outstanding. The publicly demonstrated exploit chains CVE-2023-29357 (auth bypass / elevation of privilege) into CVE-2023-24955 (code execution). Patching only one leaves part of the path open. Apply both SharePoint security updates from the same period.

Are there Linux or container fixes for this?

No. SharePoint Server runs only on Windows Server. There is no apt, dnf, rpm, or Docker fix, the remediation is the Windows security update for your SharePoint edition followed by the PSConfig database upgrade.

References

• Official vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-24955
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24955
• Additional reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24955

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Additional nearby issues sensible to fix in the same maintenance window:

• How to Fix CVE-2023-38180: Uncontrolled Resource Consumption in Asp.Net Core 2.1
• How to Fix CVE-2023-36563: Improper Input Validation in Windows 10 Version 1809
• How to Fix CVE-2023-21674: Use After Free in Windows 10 Version 1809
• How to Fix CVE-2023-29336: Use After Free in Windows 10 Version 1507
• How to Fix CVE-2023-21823: Integer Overflow or Wraparound in Microsoft Office For Android