🧠 CVE-2025-53770 : Critical SharePoint RCE Vulnerability Exploited via ViewState Forgery

📌 Vulnerability Overview

• Type: Remote Code Execution (RCE)
• CVSS Score: 9.8 (Critical)
• Component: Microsoft SharePoint Server (on-prem)
• Root Cause: Insecure deserialization of ViewState data using stolen ASP.NET machineKey (ValidationKey and DecryptionKey).
• Exploitation: Requires no authentication.
• Status: Actively exploited in the wild.
• Date Disclosed: July 19, 2025
• Discovered/Reported by: Multiple security vendors and government incident response teams.

---

🛠️ Technical Details

1. Initial foothold:

   • Attackers upload a crafted .aspx file (e.g., spinstall0.aspx) exploiting SharePoint’s deserialization flaws.
   • This shell reads sensitive keys (machineKey) from memory.

2. Persistence:

   • With those keys, attackers generate malicious ViewState payloads.
   • These payloads bypass signature verification and execute arbitrary code under IIS worker process w3wp.exe.

3. No patch = persistent access, even after server reboot or app pool recycling.

---

📂 Affected Products

---

📡 Exploitation Indicators

• Upload of spinstall0.aspx or similar shell files.

• Requests to:

  • /sites/*/_layouts/15/ToolPane.aspx?DisplayMode=Edit
  • With referrer: _layouts/SignOut.aspx

• w3wp.exe spawning cmd.exe, powershell.exe, or rundll32.

---

🧪 Detection Tips

Web Logs:

• Look for unusual POST requests to SharePoint layout pages.
• Search for access logs involving /layouts/ with uncommon user agents.

File System:

• Scan for unrecognized .aspx files in:

  • %ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\

Processes:

• Monitor for anomalous child processes under w3wp.exe.

Network:

• Detect outbound connections to known attacker IPs:

  • 107.191.58.76, 96.9.125.147, 104.238.159.149

---

🔐 Mitigation

Before Patch:

1. Enable AMSI:

   • Use Microsoft Defender Antivirus with AMSI support.
   • AMSI can detect malicious ViewState payloads before execution.

2. Apply Network Controls:

   • Restrict SharePoint server access to internal networks only.

3. Deploy EDR/XDR:

   • Use Defender for Endpoint or similar for behavioral detection.

After Patch:

1. Install July 2025 Updates:

   • Microsoft released hotfixes for SharePoint 2016, 2019, and Subscription Edition.

2. Rotate machineKey:

   • Change ASP.NET ValidationKey and DecryptionKey in web.config.
   • Force restart of IIS (iisreset) to apply changes.

3. Audit & Cleanup:

   • Remove rogue .aspx files.
   • Check for scheduled tasks or persistence mechanisms.

---

🛡️ Summary

• A high-impact zero-day in SharePoint allows full server compromise via forged ViewState payloads.
• Active exploitation confirmed.
• Patch immediately, rotate encryption keys, and scan for compromise indicators.

---