Microsoft SharePoint Exploit Attempt - CVE-2023-29357

Administrators can enable Open Authorization version 2.0 (OAuth 2.0) on Microsoft SharePoint Server to authorize access to restricted pages. OAuth is a token-based workflow that enables third-party services to access restricted pages by exchanging tokens. When Oauth 2.0 is enabled, SharePoint has a token validation vulnerability that allows an attacker to bypass authentication and perform actions on the server. To exploit this vulnerability, the attacker sends the SharePoint server a malicious HTTP request with a forged JSON Web Token (JWT) to impersonate a system administrator. JWT is an open source industry standard for sharing information between clients and servers. The vulnerable SharePoint server validates the JWT and the attacker can install malware, run commands, or collect information.