The Shadow Over SharePoint – CVE-2025-53770

Introduction: The Silent Siege

In July 2025, a storm engulfed on-premises Microsoft SharePoint environments worldwide. CVE-2025-53770—a critical unauthenticated remote code execution (RCE) vulnerability—has been actively exploited by advanced threat actors, compromising government agencies, energy firms, and universities. This flaw isn’t just another entry in the CVE catalog; it’s a potent weapon enabling total server takeover. Here’s what you need to know.

1. Vulnerability Overview: Anatomy of CVE-2025-53770

CVE-2025-53770 is a deserialization flaw in on-premises SharePoint Server (2016, 2019, Subscription Edition). Attackers chain it with CVE-2025-49706 (spoofing) and CVE-2025-49704 (RCE) to form “ToolShell”—a bypass granting unauthenticated access to execute arbitrary code. Unlike SharePoint Online, on-prem deployments are exclusively vulnerable

Key Technical Mechanics:

• Attack Vector: A forged Referer: /_layouts/SignOut.aspx header in a POST request to /_layouts/15/ToolPane.aspx bypasses authentication
  
  
• Exploitation Chain:
  
  1. Authentication Bypass: SharePoint skips form digest validation.
     
     
  2. Web Shell Upload: Malicious file (e.g., spinstall0.aspx) is written to the LAYOUTS directory.
     
     
  3. Key Theft: The script extracts ValidationKey and DecryptionKey from web.config.
     
     
  4. RCE via ViewState: Attackers craft signed __VIEWSTATE payloads using tools like ysoserial to execute commands.
     

2. Attacker Intent: Beyond Initial Access

Threat actors—including Chinese state groups Linen Typhoon, Violet Typhoon, and Storm-2603—aim for persistent control and data exfiltration. Their objectives:

• Cryptographic Key Theft: MachineKeys enable future token forgery even after patching.
  
  
• Lateral Movement: Compromised SharePoint servers act as gateways to Outlook, Teams, and OneDrive.
  
  
• Espionage & Data Theft: Targeting defense, energy, and government sectors for intellectual property.
  
  

3. Known Indicators of Compromise (IOCs)

Detection Queries:

• Microsoft 365 Defender:
  

DeviceFileEvents  
| where FolderPath has_any ("microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS", "15\\TEMPLATE\\LAYOUTS")  
| where FileName has "spinstall0"

DeviceFileEvents  
| where FolderPath has_any ("microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS", "15\\TEMPLATE\\LAYOUTS")  
| where FileName has "spinstall0"

• Trend Vision One:
  

eventSubId: 901 AND objectRawDataStr: "TEMPLATE\LAYOUTS\spinstall0.aspx"

eventSubId: 901 AND objectRawDataStr: "TEMPLATE\LAYOUTS\spinstall0.aspx"

4. Microsoft’s Mitigation Strategies

Immediate Actions:

Set-SPMachineKey -WebApplication <WebApplicationPipeBind>  
Update-SPMachineKey -WebApplication <WebApplicationPipeBind>  

Set-SPMachineKey -WebApplication <WebApplicationPipeBind>  
Update-SPMachineKey -WebApplication <WebApplicationPipeBind>  

4. Isolate Vulnerable Servers:

• Disconnect public-facing SharePoint instances if patching is delayed

Advanced Protections:

• Microsoft Defender for Endpoint: Detects post-exploit activities like “Possible web shell installation” or “Suspicious IIS worker process behavior”
  
  
• Vulnerability Management: Use Microsoft Defender Vulnerability Management to track exposure via CVEs (e.g., CVE-2025-53770)
  

5. Broader Implications & Proactive Defense

• CISA KEV Listing: Added on July 20, 2025, mandating federal agencies to mitigate immediately
  
  
• Patching Isn’t Enough: Key rotation is non-negotiable—stolen MachineKeys allow persistent access 
  
  
• Sector Impact: 50+ breaches observed in energy, education, and European governments
  
  

Table 2: MITRE ATT&CK Techniques Observed

Conclusion: The Road to Resilience

CVE-2025-53770 epitomizes the evolving threat landscape—where patched vulnerabilities morph into deadlier variants. For SharePoint administrators, the mandate is clear:

1. Patch relentlessly.
   
   
2. Rotate keys aggressively.
   
   
3. Hunt continuously for IOCs.
   
   

As Microsoft notes, AMSI + Defender AV is a critical shield even before updates. In cybersecurity, complacency is the adversary. Fortify your SharePoint gates—before the next siege begins.

Resources:

• Microsoft’s Customer Guidance 
• CISA Emergency Directive 
• Threat Hunting Queries 
• https://www.helpnetsecurity.com/2025/07/20/microsoft-sharepoint-servers-under-attack-via-zero-day-vulnerability-with-no-patch-cve-2025-53770/
• https://www.picussecurity.com/resource/blog/cve-2025-53770-critical-unauthenticated-rce-in-microsoft-sharepoint
• https://thecyberthrone.in/2025/07/21/cisa-adds-cve-2025-53770-sharepoint-vulnerability-to-kev/
• https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
• https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
• https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
• https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-enterprise-server-2016-language-pack-july-21-2025-kb5002759-23cb08ac-ff17-4ee8-81cb-70bff24e0b16
• https://www.microsoft.com/en-us/download/details.aspx?id=108285
• https://www.picussecurity.com/resource/blog/cve-2025-53770-critical-unauthenticated-rce-in-microsoft-sharepoint
• https://www.cyber.gc.ca/en/alerts-advisories/al25-009-vulnerability-impacting-microsoft-sharepoint-server-cve-2025-53770