SharePoint "ToolShell" RCE Exploit (CVE-2025-53770)

Overview

CVE-2025-53770 is a critical remote code execution (RCE) vulnerability affecting Microsoft SharePoint Server 2016, 2019, and Subscription Edition (on-premises only, not SharePoint Online). Attackers can bypass authentication and achieve full server control by exploiting a logic flaw and unsafe deserialization. This exploit chain—publicly known as "ToolShell"—has been observed in active attacks.

Technical Details

Affected Versions

• SharePoint Enterprise Server 2016
• SharePoint Server 2019
• SharePoint Server Subscription Edition
• Not applicable to SharePoint Online (Microsoft 365)

Severity

• CVSS Score: 9.8 (Critical)

Exploit Chain: Step-by-Step

1. Authentication Bypass

• The attacker sends a specially crafted HTTP POST request to the hidden management page:
  /_layouts/15/ToolPane.aspx?DisplayMode=Edit
• The request contains a forged Referer header:

  Referer: /_layouts/SignOut.aspx
  

• Due to a logic flaw, SharePoint treats this request as coming from a legitimate, authenticated session, granting access.

2. Remote Code Execution via Deserialization

• Using access to the privileged endpoint, the attacker submits a payload exploiting an unsafe deserialization bug, allowing arbitrary code execution.
• Typically, the attacker uploads a malicious ASPX web shell (e.g., spinstall0.aspx) to the SharePoint system directory.

3. Web Shell Deployment and Key Theft

• The web shell is executed, letting the attacker read sensitive SharePoint configuration files.
• The attacker extracts the server's machine keys:
  • ValidationKey
  • DecryptionKey
• These cryptographic keys protect user authentication tokens and session state (ViewState).

4. Full Server Takeover and Persistence

• With the keys, the attacker can create their own valid, signed payloads that SharePoint will trust and execute.
• This enables persistent RCE and allows bypass of most security controls, even after initial patching—unless the stolen keys are rotated.

Impact

• Total compromise of on-premises SharePoint server:
  • Arbitrary command execution
  • File access/modification
  • Data exfiltration
  • Lateral movement throughout the internal network
• Persistence: Attackers maintain access using stolen machine keys until those keys are manually changed.

Example Attack Flow (Diagram)

sequenceDiagram
    participant Attacker
    participant SharePoint Server

    Attacker->>SharePoint Server: POST /ToolPane.aspx (with fake Referer)
    SharePoint Server-->>Attacker: Grants admin access (auth bypass)
    Attacker->>SharePoint Server: Uploads malicious web shell
    Attacker->>SharePoint Server: Executes web shell to read config
    SharePoint Server-->>Attacker: Returns ValidationKey and DecryptionKey
    Attacker->>SharePoint Server: Sends forged, signed payloads (persistent RCE)

Remediation

• Apply Microsoft patches:
  Official Advisory & Updates (Microsoft MSRC)
• Immediate machine key rotation after compromise
• Audit server for unauthorized ASPX files and unusual activity

References

• CISA KEV Catalog - CVE-2025-53770
• Microsoft MSRC Advisory
• Technical Write-up: "ToolShell" exploit

This document is for research and defensive purposes only. Do not attempt exploitation on systems you do not own or have explicit authorization to test.