---
title: "SharePoint code-injection RCE (CVE-2023-24955)"
canonical: https://trickest.com/library/cve-2023-24955-sharepoint-code-injection-rce
description: "Flag SharePoint hosts for CVE-2023-24955 by reading MicrosoftSharePointTeamServices on /_layouts/15/start.aspx. Unauth May 2023 floors only."
---

# SharePoint code-injection RCE (CVE-2023-24955)

## Overview

This workflow finds Microsoft SharePoint Server and sorts each host by whether its build falls below the CVE-2023-24955 May 2023 floors. CVE-2023-24955 is authenticated code injection that can lead to remote code execution on SharePoint. This check never authenticates and never injects code. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/_layouts/15/start.aspx`, fingerprints SharePoint from response markers, reads the `MicrosoftSharePointTeamServices` build, and compares it to the per-edition table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a patch-level signal only.

Run it on a schedule when on-prem SharePoint farms lag on cumulative updates. A site collection that missed the May 2023 KBs is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/_layouts/15/start.aspx` on each host and fingerprint SharePoint from markers such as `MicrosoftSharePointTeamServices`, `/_layouts/15/`, and `X-SharePointHealthScore`.
3. Parse the `MicrosoftSharePointTeamServices` build and compare it to the CVE-2023-24955 per-edition floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether SharePoint was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/_layouts/15/start.aspx` only. No authenticated session and no code-injection probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one SharePoint host below a May 2023 floor, one at or above its edition floor, and one host that is not the product.

```jsonl
{"url": "https://sp.example.com", "is_product": true, "product_version": "16.0.10397.20000", "vulnerable": true, "detail": "below SharePoint 2019 floor build 10398"}
{"url": "https://sp.example.org", "is_product": true, "product_version": "16.0.10398.20000", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Microsoft SharePoint Server"}
```

```json
{"cve": "CVE-2023-24955", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which SharePoint versions does this flag?

Per-edition May 2023 floors in the graph: SharePoint 2016 build 5395 (16.0.5395.1000), SharePoint 2019 build 10398 (16.0.10398.20000), and Subscription Edition build 16130 (16.0.16130.20420). The compare uses the `MicrosoftSharePointTeamServices` value the response itself served.

### Does an affected row mean code injection ran?

No. The check only GETs `/_layouts/15/start.aspx` and reads the build. It does not authenticate, does not inject code, and does not prove an auth precondition.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of a public layouts page. It does not log in or change farm state.

### Does the check need credentials?

No. It fingerprints the public layouts surface. The underlying CVE is authenticated; this workflow only reads the unauthenticated build signal.

### What is CVE-2023-24955?

Authenticated code injection in Microsoft SharePoint Server that can lead to remote code execution. This workflow maps hosts to that CVE by unauthenticated build exposure only.

## Related workflows

- [SharePoint XML RCE (CVE-2019-0604)](/library/cve-2019-0604-sharepoint-xml-deserialization-rce). Reach for it when you need the earlier SharePoint XML deserialization fingerprint.
- [SharePoint RCE (CVE-2025-53770)](/library/sharepoint-rce-check-cve-2025-53770). Reach for it when you need a later SharePoint ToolPane exposure check.

---
_Markdown source of https://trickest.com/library/cve-2023-24955-sharepoint-code-injection-rce._