# SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know

ToolShell chain bypasses SharePoint auth via forged Referer, then unsafe deserialization in ToolPane.aspx yields RCE and web shell for machineKey theft.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft SharePoint Server
- Credited: Wiz Research
- Disclosed: 2025-07-21
- CVE: CVE-2025-53770, CVE-2025-53771
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k
- Tags: domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:dotnet technique:chained technique:incomplete-fix vuln:auth-bypass vuln:deserialization vuln:rce

**Target:** On-premises SharePoint Server (ToolPane.aspx, ViewState/machineKey)
**Root cause:** CVE-2025-53771 lets a forged Referer header (/ _layouts/SignOut.aspx) bypass auth on ToolPane.aspx; CVE-2025-53770 deserializes untrusted POST data without validation. Both are incomplete-fix bypasses of CVE-2025-49706 and CVE-2025-49704.
**Steps:**
1. POST to `/_layouts/15/ToolPane.aspx?DisplayMode=Edit` with `Referer: /_layouts/SignOut.aspx` to bypass authentication
2. Send malicious serialized payload in POST body; SharePoint deserializes it, executing embedded commands
3. Web shell `spinstall0.aspx` dropped to `...\16\TEMPLATE\LAYOUTS\`
4. Use web shell to read ValidationKey and DecryptionKey from machineKey config
5. Forge signed `__VIEWSTATE` payloads with ysoserial using stolen keys for unauthenticated RCE
**How found:** Grounded in Pwn2Own Berlin demo by Viettel of CVE-2025-49704+49706; after July patch, CODE WHITE reproduced original chain and Eye Security observed actors finding new paths bypassing the same core logic.
**Exploitation:** Attacker chains auth bypass and deserialization to drop an ASPX web shell, extracts machineKey ValidationKey/DecryptionKey, then forges signed ViewState payloads via ysoserial to execute code persistently even after initial foothold; w3wp.exe spawns encoded PowerShell.
**Escalation:** Web shell enables key extraction, which upgrades to persistent unauthenticated RCE via forged ViewState signatures.
**Insight:** When a deserialization/auth-bypass chain is patched, re-test the same endpoint with alternate header values and re-check whether machineKey/ViewState trust still allows forged signed payloads post-foothold.