SharePoint ToolPane RCE Exploit

Security research toolkit for testing SharePoint ToolPane vulnerabilities

Overview • Features • Getting started • Usage • Project structure

This repository contains proof-of-concept exploits and analysis tools for the SharePoint ToolPane vulnerability (CVE-2025-53770). The project demonstrates exploitation techniques including authentication bypass and unsafe deserialization vulnerabilities affecting Microsoft SharePoint Server.

[!WARNING] For authorized security testing only. This project is intended for educational purposes, penetration testing, and security research on systems you own or have explicit permission to test.

Overview

CVE-2025-53770 is a critical vulnerability in Microsoft SharePoint Server that allows unauthenticated remote code execution through a combination of authentication bypass and unsafe deserialization. This vulnerability affects SharePoint Server 2019 and is particularly dangerous as it requires no authentication.

The vulnerability chain includes:

• CVE-2025-49706 - Authentication bypass affecting ToolPane.aspx
• CVE-2025-53771 - Patch bypass for CVE-2025-49706
• CVE-2025-49704 - Unsafe deserialization vulnerability
• CVE-2025-53770 - Patch bypass targeting different endpoints

Features

• Multiple exploitation methods - Python and cURL implementations
• Target scanning - Automated vulnerable version detection
• Payload analysis - Tools to decode and analyze exploit payloads
• Comprehensive documentation - Detailed vulnerability analysis and exploitation guidance
• Real-world testing - Proven against multiple SharePoint versions

Getting started

Prerequisites

• Python 3.x with requests and urllib3 libraries
• Network access to target SharePoint servers
• Authorization to test target systems

Usage

Scanning for vulnerable targets

Use the scanner to identify potentially vulnerable SharePoint installations:

python3 scanner/scanner.py <target_ip_or_hostname>

Running the exploit

Python exploitation

Execute the main Python exploit against a target:

python3 exploit/exploit.py <target_ip_or_hostname>

Example output:

[+] Targeting: http://192.168.1.100
[+] Sending exploit payload...
[+] Response Status: 200
[+] Response Length: 1234 bytes

cURL testing

Test using the provided cURL commands:

# Review the cURL file for specific commands
cat metasploit_ref/cURL

Analyzing responses

Use the analysis tool to decode and examine exploit responses:

python3 analysis/analyse.py

This tool extracts and decodes base64-encoded payloads from captured traffic.

Project structure

├── analysis/
│   └── analyse.py              # Payload analysis and decoding tools
├── exploit/
│   └── exploit.py              # Main Python RCE exploit
├── metasploit_ref/
│   ├── cURL                    # cURL command examples
│   ├── sharepoint_toolpane_rce.md  # Detailed vulnerability documentation
│   └── sharepoint_toolpane_rce.rb  # Ruby reference implementation
├── out/                        # Analysis output directory
├── scanner/
│   └── scanner.py              # Vulnerability scanner
└── README.md                   # This file

Vulnerable versions

The following SharePoint Server versions are confirmed vulnerable:

• SharePoint Server 2019 16.0.10337.12109 (RTM version)
• SharePoint Server 2019 16.0.10417.20018 (June 2025 patch level)
• SharePoint Server 2019 16.0.10417.20027 (July 2025 patch level)*

*The July 2025 patch level may still be exploitable unless administrators have manually performed configuration updates.

Disclaimer

[!CAUTION] This project is provided for educational and authorized security testing purposes only.

• Only test systems you own or have explicit written permission to test
• Unauthorized testing of systems may violate local, state, and federal laws
• Users are solely responsible for ensuring compliance with applicable laws
• The authors assume no liability for misuse of this software

Resources

• CVE-2025-53770 Details
• Microsoft Security Advisory
• SharePoint Security Best Practices

⭐ If this project helps your security research, consider starring it on GitHub!