CVE-2025-53770 SharePoint Zero-Day: In-Depth Analysis, Detection & Defence

In July 2025, security teams across the globe were put on high alert following the discovery of CVE‑2025‑53770, a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting on-premise Microsoft SharePoint Server 2016, 2019, and Subscription Edition.

Nicknamed "ToolShell" due to its abuse of SharePoint's ToolPane.aspx, this zero-day was actively exploited in the wild, allowing attackers to completely compromise unpatched SharePoint servers, without authentication.

This blog provides a deep technical breakdown, timeline, real-world impact, detection strategies, and steps defenders must take to mitigate risk immediately.

What is CVE-2025-53770?

CVE‑2025‑53770 is an unauthenticated RCE vulnerability that allows attackers to send a specially crafted POST request to a SharePoint server's ToolPane.aspx?DisplayMode=Edit endpoint. By spoofing the Referer header (/layouts/SignOut.aspx), attackers bypass SharePoint’s usual authentication and form-digest validation.

How It Works (TL;DR):

• Bypass authentication using a spoofed HTTP header.

• Upload a malicious .aspx web shell (spinstall0.aspx).

• Extract SharePoint’s MachineKey from memory using .NET reflection.

• Use those keys to sign __VIEWSTATE payloads and trigger remote code execution.

Impact: Full server compromise, credential theft, and the potential to pivot deeper into enterprise infrastructure.

CVE-2025-53770

Timeline of Events

Date	Event
July 18, 2025	Exploitation first observed in the wild (Trend Micro, Eye Security)
July 19, 2025 to July 20, 2025	Microsoft confirms the exploit and issues emergency patches
July 20, 2025	CISA adds CVE‑2025‑53770 to the Known Exploited Vulnerabilities (KEV) catalog
July 21, 2025	SharePoint 2016 patch released to complete the coverage of vulnerable versions

Why CVE-2025-53770 is So Dangerous

• Zero authentication required

• Bypasses previous patch protections

• Leads to persistent RCE via signed payloads

Technical Exploit Walkthrough

1. Authentication Bypass

   1. A POST request is made to /layouts/15/ToolPane.aspx?DisplayMode=Edit, but with a forged referer header: Referer: /_layouts/SignOut.aspx

   2. This tricks the server into thinking the request is internal.

2. Malicious Web Shell Upload

   1. The attacker drops a custom .aspx file (spinstall0.aspx) into the SharePoint web directory.

3. MachineKey Theft

   1. The shell uses .NET reflection to extract:

      1. ValidationKey

      2. DecryptionKey from the SharePoint web.config file (usually protected).

   2. These keys are used to sign forged __VIEWSTATE payloads that will later execute arbitrary code.

4. VIEWSTATE Payload Injection

   1. Using tools like ysoserial.net, attackers generate malicious __VIEWSTATE blobs (with embedded PowerShell or CMD) signed using the stolen keys.

   2. This leads to execution of commands like: w3wp.exe → cmd.exe → powershell.exe -EncodedCommand [payload]

   
   

Real-World Impact

Victims:

• Government agencies

• Financial institutions

• Healthcare organizations

• Legal & education sectors

Scale:

• 75+ breached SharePoint servers

• Public exploitation confirmed by multiple vendors (Trend Micro, Arctic Wolf, Rapid7)

• Thousands more remain vulnerable due to slow patching

How to Detect Exploitation

1. Detect Abnormal HTTP Requests

   1. Look for POSTs to: /layouts/15/ToolPane.aspx?DisplayMode=Edit with Referer: /_layouts/SignOut.aspx

2. Monitor File System

   1. Check for: *\spinstall0.aspx

3. Watch Suspicious Process Chains using Sigma rules

4. Monitor VIEWSTATE Abuse

   1. If using WAF or application logs, look for unusually long or base64‑encoded __VIEWSTATE parameters.

Defensive Recommendations

1. Patch now!

2. Rotate MachineKey (via Central Admin or PowerShell)

3. Remove suspicious .aspx files

CVE-2025-53770 is not just another vulnerability, it represents the growing sophistication of authentication bypass and deserialization chains. Its combination of ease of exploitation, authentication bypass, and deep system control makes it one of the most dangerous SharePoint bugs ever disclosed.

This isn't a 'maybe-later' patch. If you're running on-prem SharePoint, it's a 'patch-yesterday' situation.

Happy cyber-exploration! 🚀🔒

Note: Feel free to drop your thoughts in the comments below - whether it's feedback, a topic you'd love to see covered, or just to say hi! Don’t forget to join the forum for more engaging discussions and stay updated with the latest blog posts. Let’s keep the conversation going and make cybersecurity a community effort!

-AJ