ET WEB_SPECIFIC_APPS Microsoft SharePoint Authentication Bypass and Privilege Escalation (CVE-2023-29357)

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (
    msg:"ET WEB_SPECIFIC_APPS Microsoft SharePoint Authentication Bypass and Privilege Escalation (CVE-2023-29357)";
    flow:established,to_server;
    http.uri;
    content:"/_api/web/siteusers"; fast_pattern;
    http.header;
    content:"X-PROOF_TOKEN|3a 20|";
    base64_decode:relative;
    base64_data;
    content:"|22|alg|22 3a 22|none|22|";
    reference:url,sec.vnpt.vn/2023/08/phan-tich-cve-2023-29357-microsoft-sharepoint-validatetokenissuer-authentication-bypass-vulnerability;
    reference:cve,2023-29357;
    classtype:web-application-attack;
    sid:2071421; rev:1;
    metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2026_08_07, cve CVE_2023_29357, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2026_08_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)