URGENT ADVISORY: ToolShell — Critical SharePoint RCE Chain Under Active Exploitation

TL;DR: If you run on-premises SharePoint Server — 2013, 2016, 2019, or Subscription Edition — you are vulnerable to unauthenticated remote code execution. Attackers have been exploiting the bypass chain since July 17, 2025 (before Microsoft issued emergency out-of-band patches on July 20). The exploit chain bypasses authentication, executes arbitrary code, steals cryptographic keys, and plants persistence that survives re-patching. SharePoint Online / Microsoft 365 is not affected.

1. WHAT HAPPENED

Microsoft discovered four critical vulnerabilities in on-premises SharePoint Server that attackers exploited in a coordinated chain:

CVE-2025-49706 — Authentication bypass via forged Referer header on ToolPane.aspx (discovered by Viettel at Pwn2Own Berlin, May 16, 2025)

CVE-2025-49704 — Remote code execution via insecure deserialization in DataSetSurrogateSelector (co-discovered by Viettel at Pwn2Own Berlin)

CVE-2025-53770 — Bypass of Microsoft's July 8 Patch Tuesday fix for CVE-2025-49704 (the same technique, using pathinfo appended to the URL)

CVE-2025-53771 — Bypass of the July 8 Patch Tuesday fix for CVE-2025-49706

CVE-2025-49706 and CVE-2025-49704 were patched on July 8, 2025 (Patch Tuesday). The bypasses (CVE-2025-53770 and CVE-2025-53771) were confirmed under active exploitation starting July 17, 2025. Microsoft issued emergency out-of-band patches on July 20, 2025. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog the same day (due date: July 21 for federal agencies).

2. THE EXPLOIT CHAIN — STEP BY STEP

Stage 1: Authentication Bypass (CVE-2025-49706 → CVE-2025-53771)

An unauthenticated attacker sends a POST request to:

POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit

with a forged Referer header pointing to a benign SharePoint page (e.g., /layouts/SignOut.aspx). This tricks SharePoint's Referer validation into believing the request comes from an authenticated session, granting the attacker access to the ToolPane web-part configuration page without any credentials.

CVE-2025-49706 was the original logic flaw in SharePoint's Referer validation — discovered by Viettel at Pwn2Own Berlin (May 16, 2025). CVE-2025-53771 bypasses Microsoft's July 8 Patch Tuesday fix using the same pathinfo trick appended to the ToolPane.aspx URL.

Stage 2: Remote Code Execution (CVE-2025-49704 → CVE-2025-53770)

Once unauthenticated access to ToolPane.aspx is achieved, the attacker injects a crafted deserialization payload targeting DataSetSurrogateSelector. SharePoint processes this payload, resulting in arbitrary code execution under the IIS worker process (w3wp.exe).

CVE-2025-49704 was the original insecure deserialization flaw (also discovered at Pwn2Own Berlin). CVE-2025-53770 bypasses the July 8 Patch Tuesday fix via pathinfo appending to restore full exploitability despite the validation logic Microsoft added.

Stage 3: Persistence and Key Theft

After code execution, attackers follow a predictable pattern:

1. Deploy a webshell — typically spinstall0.aspx or xxx.aspx in the SharePoint LAYOUTS directory
2. Extract the ASP.NET machine key from web.config: ValidationKey — used to forge Forms Authentication cookies; DecryptionKey — used to decrypt ViewState payloads; Cryptographic mode (MAC/Encryption algorithm)
3. Establish persistent access — With stolen keys, attackers can: Forge Forms Authentication cookies (full admin access); Generate valid ViewState payloads (persistent RCE without any webshell on disk); This backdoor survives server reboots and even re-patching

The third stage is what makes ToolShell uniquely dangerous. Patching alone does not remove an active compromise.

3. AFFECTED VERSIONS

SharePoint Online / Microsoft 365 — NOT AFFECTED. If your SharePoint is hosted in Microsoft's cloud, you do not need to take action for these CVEs. Homelab admins who run SharePoint Server on self-hosted VMs — whether for documentation wikis, intranet portals, or collaboration tools — are in scope. This is not a cloud-only issue.

4. IMMEDIATE MITIGATION

Step 1: Apply the emergency patch

Install the appropriate KB for your version. Do not skip the language pack — Microsoft confirmed the bypass works on unpatched language packs.

Step 2: Enable AMSI integration

Enable Microsoft Defender's Advanced Scripting Monitor (AMSI) on all SharePoint servers. Specifically, enable Full Mode HTTP Request Body scanning. This was Microsoft's and CISA's recommended compensating control before patches were available and remains useful as a defense-in-depth layer.

Step 3: Rotate machine keys — MANDATORY IF EXPOSED

If your SharePoint server has been internet-facing since July 17, 2025, assume the machine key was stolen. Rotate it immediately:

Set-SPMachineKey -WebApplication <SPWebApplicationPipeBind>
Update-SPMachineKey -WebApplication <SPWebApplicationPipeBind>
iisreset.exe

Run this on every SharePoint server in the farm. Without key rotation, attackers retain the ability to forge authentication cookies and generate ViewState payloads indefinitely — even after patching.

Step 4: Scan for webshells

Check these directories on every SharePoint front-end server:

C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS\\
C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS\\

Look for:

spinstall0.aspx — primary observed webshell

xxx.aspx — secondary webshell

Any .dll files matching App_Web_spinstall0.aspx.*.dll

Step 5: Isolate if you cannot patch immediately

If immediate patching is not feasible, isolate internet-facing SharePoint servers behind a VPN, proxy, or authentication gateway. This is not a long-term solution — apply the patch as soon as possible.

5. DETECTION — WHAT TO LOOK FOR

Web logs (IIS / reverse proxy)

Search for POST requests to ToolPane.aspx?DisplayMode=Edit from unauthenticated or low-integrity users. Look for Referer headers containing signout URLs (/layouts/SignOut.aspx) — this is the auth bypass fingerprint.

File system

New .aspx files appearing in LAYOUTS directories. Modified web.config files with unexpected <machineKey> entries.

Process behavior

PowerShell execution spawned from the SharePoint IIS worker process (w3wp.exe). This is a strong indicator of compromise — w3wp.exe should not be spawning PowerShell or cmd.exe.

AMSI / Defender alerts

Microsoft Defender names these threats:

Exploit:Script/SuspSignoutReq.A

Trojan:Win32/HijackSharePointServer.A

Exploit:Script/SuspSignoutReqBody.A

Trojan:PowerShell/MachineKeyFinder.DA!amsi

IOC Hashes (SHA256)

f5b60a8ead96703080e73a1f79c3e70ff44df271  — spinstall0.aspx webshell
fe3a3042890c1f11361368aeb2cc12647a6fdae1    — xxx.aspx webshell
76746b48a78a3828b64924f4aedca2e4c49b6735    — compiled App_Web_spinstall0.aspx DLL

IOC IPs (SentinelOne observed)

96.9.125.147      — "no shell" cluster (fileless, in-memory .NET execution)
107.191.58.76     — Wave 1 spinstall0.aspx deployment
104.238.159.149   — Wave 2 spinstall0.aspx deployment

6. HOW THIS RELATES TO CVE-2025-49706 AND CVE-2025-49704

This is the critical distinction many articles get wrong:

CVE-2025-53770 and CVE-2025-53771 are not separate vulnerabilities — they are the same exploit technique applied to bypass Microsoft's July 8 Patch Tuesday fixes. The mechanism is pathinfo appended to the ToolPane.aspx URL. This is a "patch-bypass" attack pattern, not a zero-day in the traditional sense. Microsoft assigned CVSS scores of 9.8 (Critical) for CVE-2025-53770 and 6.3 (Medium) for CVE-2025-53771.

7. SIGNS YOU'VE BEEN COMPROMISED

New .aspx files in SharePoint LAYOUTS directories

Modified web.config with unexpected <machineKey> entries

PowerShell or cmd.exe spawned from w3wp.exe

Base64-encoded binary payloads decoded to LAYOUTS directories

Unexpected outbound connections from SharePoint servers

Large ViewState payloads (>10 KB) — possible forged payloads using stolen keys

Defender alerts: "Possible web shell installation" or "Possible exploitation of SharePoint server vulnerabilities"

If you see any of these, patch first, then rotate machine keys, then scan thoroughly. Patching without key rotation leaves a permanent backdoor.

8. SCALE OF IMPACT

54+ organizations affected across 10 countries (Microsoft + BleepingComputer)

75–85+ servers compromised (Bitsight / DQIndia)

~9,000 services at risk globally (Bitsight estimate)

16,000+ internet-exposed SharePoint servers on Shodan (Viettel Threat Intelligence)

If you run SharePoint Server and it's internet-facing, the probability of being targeted is high.

9. ACTION CHECKLIST

• Verify your SharePoint Server version against the affected table above
• Apply the appropriate emergency KB patch
• Install the language pack patch if applicable
• Enable AMSI with Microsoft Defender
• If internet-facing since July 17, 2025: rotate machine keys on all farm servers
• Scan LAYOUTS directories for spinstall0.aspx, xxx.aspx, and suspicious .dll files
• Check IIS logs for POST requests to ToolPane.aspx?DisplayMode=Edit
• Check for w3wp.exe spawning PowerShell or cmd.exe
• Verify no unexpected <machineKey> entries in web.config
• Isolate internet-facing servers if patching is delayed

This advisory is based on Microsoft MSRC, Unit 42, Qualys, SentinelOne, Viettel, Contrast Security, Bitsight, Orca, CISA, and NVD public reporting.

SharePoint Online / Microsoft 365 is not affected.