CVE-2025-53770: 
vulnerability analysis and mitigation

CVE-2025-53770, dubbed ToolShell, is a critical deserialization of untrusted data vulnerability in on-premises Microsoft SharePoint Server that allows unauthenticated remote attackers to execute arbitrary code over a network without user interaction. It affects SharePoint Server 2016 (Enterprise), SharePoint Server 2019, and SharePoint Server Subscription Edition (versions prior to 16.0.18526.20508); SharePoint Online and Microsoft 365 are not affected. Microsoft first disclosed the vulnerability on July 19, 2025, with active exploitation confirmed by July 20, 2025, and emergency patches released on July 21, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical) (Microsoft MSRC, Ars Technica).

The root cause is CWE-502 (Deserialization of Untrusted Data), exploited through a chained attack involving two related vulnerabilities: CVE-2025-49706 (authentication bypass) and CVE-2025-49704 (spoofing), both partially patched in Microsoft's July 2025 Patch Tuesday. The exploit chain, first demonstrated at Pwn2Own Berlin in May 2025, allows attackers to extract the ASP.NET ValidationKey and MachineKey from SharePoint's configuration — either from memory or the server's configuration files — via an unauthenticated request to publicly accessible SharePoint pages (e.g., /_layouts/15/start.aspx). Once the ValidationKey is obtained, attackers use tools like ysoserial to craft valid, signed __VIEWSTATE payloads that trigger server-side deserialization and arbitrary command execution without any credentials. The resulting backdoor, named ToolShell, is a webshell that reads internal .NET methods and machine key configuration rather than issuing interactive commands, making it stealthier than typical webshells (Ars Technica, Microsoft MSRC Blog).

Successful exploitation grants unauthenticated attackers full remote code execution on the SharePoint server, enabling complete server takeover, theft of ASP.NET machine keys and authentication tokens, and persistent access to internal network resources. The stolen machine keys allow attackers to forge trusted requests and pivot laterally to other systems even after patching, since the keys remain valid until explicitly rotated. Over 400 organizations across four continents were confirmed compromised, including U.S. federal agencies (DHS, the National Nuclear Security Administration), Canada's House of Commons, and Colt Technology Services, with ransomware (Warlock/LockBit) and espionage payloads (ShadowPad, Sliver, Zingdoor) deployed in follow-on attacks (Ars Technica, Microsoft MSRC Blog).

CVE-2025-53770 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 20, 2025 (CISA). Multiple public PoC exploits are available on GitHub (e.g., kaizensecurity/CVE-2025-53770), and a Metasploit module (sharepoint_toolpane_rce) was released on August 6, 2025 (Metasploit). The EPSS score is approximately 0.189 (18.9%). Three Chinese nation-state threat actors — Storm-2603, APT27, and APT31 — were attributed by Microsoft and Google as primary operators, with Storm-2603 deploying Warlock ransomware and custom BYOVD malware. Exploitation began as early as July 7, 2025, before public disclosure (Microsoft MSRC Blog, Eye Security).

1. Reconnaissance: Identify internet-facing on-premises SharePoint Server instances (2016, 2019, or Subscription Edition) using tools like Shodan, Censys, or FOFA. Approximately 17,000 SharePoint servers were found exposed to the internet, with ~840 confirmed vulnerable.

2. Authentication bypass (CVE-2025-49706): Send a crafted unauthenticated HTTP request exploiting the authentication bypass to access internal SharePoint endpoints without valid credentials.

3. Extract ValidationKey: Issue a request to a publicly accessible SharePoint page (e.g., /_layouts/15/start.aspx) and parse the __VIEWSTATEGENERATOR value. Exploit CVE-2025-49704 or the deserialization flaw to extract the server's ASP.NET ValidationKey and MachineKey from memory or configuration.

4. Craft malicious ViewState payload: Use ysoserial.exe with the extracted ValidationKey to generate a signed, malicious __VIEWSTATE payload embedding arbitrary commands (e.g., PowerShell reverse shell, file enumeration):

ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "powershell -nop -c ..." --generator=<VIEWSTATEGENERATOR> --validationkey=<KEY> --validationalg=<ALG> --islegacy --minify

5. Achieve RCE: Submit the crafted __VIEWSTATE payload in an HTTP request to any SharePoint page (e.g., /_layouts/15/success.aspx). The server deserializes the payload and executes the embedded command as the SharePoint service account.

6. Deploy ToolShell backdoor: Drop a webshell that reads internal .NET methods and machine key configuration, enabling persistent access and further credential theft.

7. Lateral movement and persistence: Use stolen machine keys and authentication tokens to forge trusted requests, pivot to other internal systems, deploy ransomware (Warlock), or establish long-term espionage footholds (Ars Technica, Eye Security).

• Network: Unusual unauthenticated HTTP POST/GET requests to /_layouts/15/start.aspx, /_layouts/15/success.aspx, or other SharePoint layout pages with anomalous __VIEWSTATE parameters; outbound connections from the SharePoint server to unknown external IPs; HTTP requests containing encoded or oversized __VIEWSTATE values.

• File System: Unexpected .aspx webshell files in SharePoint layout directories (e.g., C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\); new or modified files in SharePoint hive directories; suspicious DLL or executable files dropped by the SharePoint service account.

• Logs: IIS access logs showing repeated requests to SharePoint layout pages from external IPs with large __VIEWSTATE parameters; SharePoint ULS logs showing deserialization errors or unexpected object instantiation; Windows Event Logs showing unusual process creation by w3wp.exe (IIS worker process).

• Process: Unusual child processes spawned by w3wp.exe (e.g., powershell.exe, cmd.exe, wscript.exe); w3wp.exe making outbound network connections; unexpected use of ysoserial-related patterns in memory.

• Registry/Configuration: Unauthorized changes to ASP.NET machine key configuration (machineKey in web.config); new scheduled tasks or services created by the SharePoint service account.

• Credentials: Evidence of machine key or ValidationKey extraction from SharePoint configuration; authentication tokens used from unusual IP addresses or at unusual times (Eye Security, CISA).

Immediate patching is the primary remediation. Microsoft released emergency patches on July 21, 2025:

• SharePoint Server Subscription Edition: Update to version 16.0.18526.20508 or later.
• SharePoint Server 2019: Apply the July 2025 emergency security update.
• SharePoint Server 2016: A patch was released shortly after; apply immediately.

Post-patch mandatory steps (patching alone is insufficient if already compromised):

1. Rotate ASP.NET machine keys (ValidationKey and DecryptionKey) in SharePoint's web.config and restart IIS.
2. Revoke and reissue all authentication tokens and service account credentials.
3. Conduct a compromise assessment — assume breach if the server was internet-facing before patching.

Workarounds (if patching is not immediately possible):

• Enable the Antimalware Scan Interface (AMSI) integration for SharePoint (especially for SharePoint 2016 before its patch was available).
• Restrict internet access to SharePoint servers; place behind a WAF or reverse proxy.
• Block external access to /_layouts/ endpoints where feasible.
• Deploy Azure WAF or Cloudflare WAF rules targeting ToolShell exploitation patterns.

CISA mandated that all FCEB agencies patch by August 4, 2025 (Microsoft MSRC, CISA).

The vulnerability generated extraordinary industry and media attention. Microsoft's MSRC blog described it as requiring immediate action and confirmed Chinese nation-state involvement, attributing attacks to Storm-2603, APT27, and APT31 (Microsoft MSRC Blog). Eye Security, which discovered the active exploitation, published a detailed technical analysis and victim data, noting the attacks began July 18–19, 2025 (Eye Security). Kaspersky researchers revealed the vulnerability stems from an incomplete fix applied in 2020, adding context to the root cause. Security researchers on social media (Bluesky, Mastodon, X) widely described the situation as a "worst-case scenario" for on-premises SharePoint administrators, with CRN quoting researchers saying "patching is not enough." ENISA, CERT-EU, the UK NCSC, Australia's ACSC, Canada's CCCS, and New Zealand's CERT all issued advisories. The breach of the U.S. National Nuclear Security Administration and Canada's House of Commons generated significant mainstream media coverage from Reuters, Bloomberg, Washington Post, and the New York Times. The Warlock ransomware group's attack on Colt Technology Services, causing multi-day outages, further amplified industry concern about the real-world impact of the vulnerability.