CVE-2025-53770-Checker

Checks if an on-premises SharePoint server is vulnerable to CVE-2025-53770

Non-intrusive detector of the CVE-2025-53770 vulnerability in SharePoint Server
Development: Division81 (ethical hacking team of Grupo Oruss)

Technical Description

• CVE-2025-53770 is a critical .NET deserialization flaw in the ViewState handler of on-premises SharePoint that allows unauthenticated RCE :contentReference[oaicite:1]{index=1}.
• The exploit uses a POST to / _layouts/15/ToolPane.aspx?DisplayMode=Edit with malicious (signed) ViewState payloads that trigger SerializationException and typically write web shells (spinstall0.aspx) in the LAYOUTS folder :contentReference[oaicite:2]{index=2}.
• Part of the “ToolShell” exploit chain together with CVE-2025-49706 and CVE-2025-49704, used in recent APT campaigns :contentReference[oaicite:3]{index=3}.

Requirements

• Python ≥ 3.7
• Module requests (pip install requests)

Usage

git clone https://github.com/tu-org/division81-sp-checker.git cd division81-sp-checker pip install -r requirements.txt python check_sp_cve2025_53770.py https://sharepoint.local/ -e 2019

References

MSRC Blog: Customer guidance for SharePoint vulnerability CVE-2025-53770 https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

License

MIT © Grupo Oruss – Division81