Associated Vulnerability
Title:Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2025-53770)Description:Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Description
A critical zero-auth RCE vulnerability in SharePoint (CVE-2025-53770), now exploited in the wild, building directly on the spoofing flaw CVE-2025-49706.
Readme
# 🚨 CVE‑2025‑53770 – SharePoint Zero-Day Variant Exploited for Full RCE
**A Critical Escalation from CVE‑2025‑49706** <br/>
By **Aditya Bhatt** – Red Team | VAPT <br/>
---
## 📌 TL;DR
**CVE‑2025‑53770** is a **critical (CVSS 9.8) zero-auth RCE vulnerability** in Microsoft SharePoint now actively exploited in the wild. This isn’t a standalone issue—it’s a **variant of CVE‑2025‑49706**, which I previously covered.
But while CVE‑2025‑49706 required authentication, **53770 doesn’t**.
This is **unauthenticated code execution**, with real-world web shell drops and privilege escalation in active attacks. Patch now.
---
## 🔁 In Case You Missed It:
> I previously analyzed **[CVE‑2025‑49706](https://infosecwriteups.com/cve-2025-49706-sharepoint-spoofing-vulnerability-under-active-exploitation-3a640df68d3e)** – a spoofing vulnerability in SharePoint that allowed token manipulation, web shell uploads, and lateral movement from an authenticated foothold.
>
> **CVE‑2025‑53770** builds on the same foundation but skips the login altogether.
---
## 🧠 What is CVE‑2025‑53770?
* **Type**: Unauthenticated Remote Code Execution (RCE)
* **Severity**: **CVSS 9.8 (Critical)**
* **Affected Products**:
* SharePoint Server 2016 (unpatched)
* SharePoint Server 2019
* SharePoint Server Subscription Edition
 <br/>
---
### 🔍 Root Cause
According to Microsoft, this is a **variant of CVE‑2025‑49706** and involves **improper handling of crafted authentication tokens**—combined with malicious \_\_VIEWSTATE payloads—that lead to direct execution in IIS worker processes.
---
## ⚔️ Real-World Attacks
### 🚨 ToolShell Campaign Update:
* Attackers are chaining:
* **CVE‑2025‑49704 (deserialization bug)**
* **CVE‑2025‑49706 (spoofed header + auth bypass)**
* **CVE‑2025‑53770 (unauth RCE)**
* Dropping:
* `spinstall0.aspx` web shell
* Payloads like `SuspSignoutReq.exe`
* Persistence tools under `w3wp.exe`
### 🎯 Affected Targets (based on MSRC reports):
* Government and Education sectors
* On-prem SharePoint portals
* Any SharePoint instance exposed to the internet without July patches
---
## 🧪 Attack Flow (Simplified):
1. 📥 Malicious request sent to vulnerable endpoint (unauthenticated)
2. 🧾 Injected `__VIEWSTATE` payload or forged token bypasses validation
3. 💣 Code executed inside IIS (`w3wp.exe`) under NT AUTHORITY\SYSTEM
4. 🐚 Web shell uploaded, remote access established
5. 🛰️ C2 communication initiated, lateral movement begins
<img width="984" height="732" alt="_- visual selection" src="https://github.com/user-attachments/assets/fd082fbd-9933-42f7-8779-6962f6a24d01" /> <br/>
---
## 🛡️ Mitigation & Patching
### ✅ Patch Immediately
Microsoft released out-of-band security updates on **July 20–21, 2025**:
* **SharePoint 2019** ➝ `KB5002741`
* **SharePoint SE** ➝ `KB5002755`
* SharePoint 2016 is pending — **isolate servers ASAP**
🔗 [Microsoft Patch Catalog](https://www.catalog.update.microsoft.com)
---
### ✅ Harden Systems
* Disable external access to SharePoint until patched
* Rotate **machine keys / viewstate validation keys**
* Enable **AMSI + Defender AV** with these PowerShell flags:
```powershell
Set-MpPreference -EnableControlledFolderAccess Enabled
Set-MpPreference -EnableScriptScanning $true
```
---
### 🔎 Detection & Threat Hunting
#### IOC Examples:
* `spinstall0.aspx`
* `SuspSignoutReq.exe`
* Large encoded `__VIEWSTATE` in POST payloads
* Suspicious process tree:
* `w3wp.exe` → `cmd.exe` → `powershell.exe`
#### Defender KQL Hunt:
```kusto
DeviceFileEvents
| where FileName contains "spinstall0.aspx" or FolderPath contains "inetpub"
| where ActionType == "FileCreated"
```
---
## 🔗 Connection to CVE‑2025‑49706
| CVE ID | Access Required | Impact | Exploitation |
| ------------------ | ------------------- | -------------------------- | ------------ |
| **CVE‑2025‑49706** | Authenticated | Spoofing / Shell Drop | Confirmed |
| **CVE‑2025‑53770** | **Unauthenticated** | **RCE + SYSTEM Privilege** | **Active** |
> Microsoft confirmed 53770 as a **variant** of 49706, now weaponized into unauthenticated RCE.
---
## 🧠 Final Thoughts
This isn't just another CVE drop.
**CVE‑2025‑53770 is one of the most dangerous SharePoint vulnerabilities in recent memory.**
It builds on an already-bad spoofing flaw (49706) and eliminates the only barrier—**authentication**.
If you're running an on-prem SharePoint instance and haven't patched since **early July 2025**, assume compromise and hunt aggressively.
 <br/>
---
## 📚 References
* [Microsoft Blog – CVE-2025-53770](https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770)
* [SecurityWeek Coverage](https://www.securityweek.com/sharepoint-under-attack-microsoft-warns-of-zero-day-exploited-in-the-wild-no-patch-available/?utm_source=chatgpt.com)
* [My CVE‑2025‑49706 Analysis](https://infosecwriteups.com/cve-2025-49706-sharepoint-spoofing-vulnerability-under-active-exploitation-3a640df68d3e)
* [Wiz Threat Intel](https://www.wiz.io/vulnerability-database/cve/cve-2025-53770)
---
## 👨💻 About the Author
I'm a cybersecurity practitioner focused on offensive security, exploit analysis, and red team operations.
I’ve ranked in the top 2% on TryHackMe and published security tools like **KeySentry**, **ShadowHash**, and **PixelPhantomX**.
I hold certifications like **CEH**, **Security+**, and the **IIT Kanpur Red Team Certificate**, and write regularly for **InfoSec WriteUps** and other security platforms.
🔗 GitHub: [@AdityaBhatt3010](https://github.com/AdityaBhatt3010) <br/>
✍️ Medium: [@adityabhatt3010](https://medium.com/@adityabhatt3010) <br/>
💼 LinkedIn: [Aditya Bhatt](https://www.linkedin.com/in/adityabhatt3010) <br/>
---
File Snapshot
[4.0K] /data/pocs/cc2d3370f31580f21a6b5c9fc0bdc4c68bad2d4e
├── [1.0K] LICENSE
└── [6.2K] README.md
0 directories, 2 files
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →