In July 2025, Microsoft disclosed CVE-2025-53770, a critical deserialization remote code execution (RCE) vulnerability in on-premises SharePoint Server, dubbed "ToolShell" by researchers. Despite patches released on July 8, 2025, threat actors—including China-nexus groups—continue to exploit unpatched and misconfigured servers weeks later. According to Microsoft's advisory, the flaw allows unauthenticated attackers to execute arbitrary code via crafted ToolPane requests. This article provides a technical deep dive into the post-patch exploitation landscape, offering detection rules, mitigation strategies, and attacker TTPs to help defenders secure their SharePoint environments.
Background: What is CVE-2025-53770?
CVE-2025-53770 is a deserialization vulnerability in Microsoft SharePoint Server's ToolPane component, enabling unauthenticated remote code execution. Microsoft assigned a CVSS v3.1 score of 9.8 (Critical) due to its network-exploitable nature, low attack complexity, and lack of required privileges. The flaw stems from improper validation of serialized data in the ToolPane web part, allowing attackers to inject malicious payloads that execute with the privileges of the SharePoint application pool.
Disclosed on July 8, 2025, as part of Microsoft's Patch Tuesday, CVE-2025-53770 was actively exploited in the wild before patches were available. Microsoft's Security Update Guide confirms exploitation and urges immediate patching. The vulnerability is reminiscent of CVE-2021-31166 (HTTP.sys RCE) but targets SharePoint's deserialization logic, making it a prime target for initial access brokers and APT groups.
Affected Versions and Patch Status
CVE-2025-53770 affects SharePoint Server 2016, 2019, and Subscription Edition. Microsoft released patches on July 8, 2025, which are available via Windows Update and the Microsoft Update Catalog. The specific patched versions are:
- SharePoint Server 2016: Build 16.0.5465.1001 or later
- SharePoint Server 2019: Build 16.0.10417.20012 or later
- SharePoint Subscription Edition: Build 16.0.17328.20250 or later
Administrators should verify their build numbers and apply the latest cumulative updates. Microsoft's advisory provides direct download links and guidance. Notably, SharePoint Online (Microsoft 365) is not affected, as it runs on a different codebase and receives continuous updates.
According to Microsoft, "Customers who have applied the July 2025 security updates are protected. However, exploitation attempts may continue against unpatched systems."
Attacker TTPs and Post-Patch Exploitation
Weeks after the patch, exploitation persists due to unpatched servers, delayed patch cycles, and targeted attacks on high-value targets. Threat actors, including those tracked as China-nexus, leverage the following MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application – attackers scan for vulnerable SharePoint servers and send crafted POST requests to
/_layouts/15/ToolPane.aspx. - T1059.004: Unix Shell – payloads often spawn
cmd.exeorpowershell.exeto download and execute secondary implants. - T1505.003: Web Shell – attackers deploy web shells (e.g.,
spinstall0.aspx) to maintain persistence. - T1071.001: Web Protocols – command-and-control (C2) over HTTP/HTTPS to blend with legitimate traffic.
In observed incidents, attackers exploit the deserialization flaw to execute a PowerShell command that downloads a payload from a remote server, often using Invoke-WebRequest or certutil. The payload may be a Cobalt Strike beacon or a custom backdoor. Public reports indicate that exploitation attempts spike during weekends and holidays when security monitoring is reduced.
Detection: Sigma and YARA Rules
To detect CVE-2025-53770 exploitation, defenders can deploy the following Sigma rule, which monitors for suspicious ToolPane requests and subsequent process creation:
title: SharePoint ToolPane Deserialization Exploitation Attempt
id: 8a9b3c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-53770 via ToolPane.aspx
references:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
author: CybernytronX
date: 2025/07/15
logsource:
category: webserver
product: iis
detection:
selection:
cs-method: 'POST'
cs-uri-stem|endswith: '/_layouts/15/ToolPane.aspx'
cs-uri-query|contains: 'ToolPane'
condition: selection
falsepositives:
- Legitimate administrative activity
level: high
Additionally, a YARA rule can scan for known web shell signatures associated with ToolShell exploitation:
rule SharePoint_ToolShell_WebShell {
meta:
description = "Detects web shells used in CVE-2025-53770 exploitation"
author = "CybernytronX"
date = "2025-07-15"
reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770"
strings:
$a = "spinstall0.aspx" ascii wide
$b = "ToolPane" ascii wide
$c = "System.Web.UI.WebControls" ascii wide
condition:
any of them
}
For network detection, the following Suricata rule alerts on malicious POST requests:
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-53770 SharePoint ToolPane Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/_layouts/15/ToolPane.aspx"; http_uri; content:"ToolPane"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)
Mitigation and Hardening
Immediate patching is the primary mitigation. For organizations that cannot patch immediately, Microsoft recommends enabling AMSI (Antimalware Scan Interface) and blocking malicious requests via URL rewrite rules. Additionally, apply the following hardening measures:
- Enable SharePoint AMSI integration to detect and block malicious deserialization payloads.
- Deploy a Web Application Firewall (WAF) with custom rules to block
ToolPaneexploitation patterns. - Restrict access to
/_layouts/15/ToolPane.aspxto authenticated administrators only via IIS request filtering. - Implement least privilege for the SharePoint application pool account.
- Monitor for anomalous process creation (e.g.,
w3wp.exespawningcmd.exeorpowershell.exe) using Sysmon and EDR.
Microsoft's advisory includes a mitigation script that disables the vulnerable ToolPane web part if patching is not possible. However, this may impact functionality and should be tested in a staging environment.
Why This Matters for Defenders
The persistence of CVE-2025-53770 exploitation weeks after patch availability underscores a critical gap in patch management and incident response. Many organizations face challenges in patching on-premises SharePoint due to customizations, third-party integrations, and change-control processes. Attackers capitalize on this window, often targeting unpatched servers for initial access and lateral movement.
Moreover, the vulnerability's high CVSS score and active exploitation make it a favorite for ransomware affiliates and APT groups. Defenders must prioritize SharePoint in their vulnerability management programs, validate patch deployment, and monitor for exploitation attempts continuously. The ToolShell campaign demonstrates that even after public disclosure, attackers will exploit known vulnerabilities if given the opportunity.
Sources
- Microsoft Security Update Guide: CVE-2025-53770 — Official advisory confirming the vulnerability, patched versions, and exploitation status.
- NVD Entry for CVE-2025-53770 — CVSS score, CWE classification, and references.
- CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-53770 as actively exploited, requiring federal remediation.
Frequently Asked Questions
Is SharePoint Online affected by CVE-2025-53770?
No. SharePoint Online (Microsoft 365) is not affected because it runs on a different codebase and receives continuous updates. Only on-premises SharePoint Server 2016, 2019, and Subscription Edition are vulnerable.
How can I verify if my SharePoint server is patched?
Check the build number in SharePoint Central Administration under System Settings > Manage servers in this farm. Compare against the patched versions: 16.0.5465.1001 (2016), 16.0.10417.20012 (2019), or 16.0.17328.20250 (Subscription Edition).
What are the indicators of compromise for ToolShell exploitation?
Common IOCs include unexpected .aspx files in _layouts directories, unusual outbound HTTP requests from w3wp.exe, and Event ID 4688 logs showing w3wp.exe spawning cmd.exe or powershell.exe. Microsoft's advisory provides additional IOCs.
Can I mitigate the vulnerability without patching?
Microsoft provides a mitigation that disables the vulnerable ToolPane web part, but it may affect functionality. Alternatively, restrict access to ToolPane.aspx and enable AMSI. However, patching is the only complete fix.
Which threat actors are exploiting CVE-2025-53770?
Microsoft and other threat intelligence vendors have attributed exploitation to China-nexus groups, though other actors may also leverage the flaw. The CISA KEV catalog lists it as actively exploited.
Need expert help with this?
If your organization runs on-premises SharePoint and you're concerned about CVE-2025-53770 or other critical vulnerabilities, CybernytronX can help. Our team offers penetration testing, SOC build-out, and threat detection using Ethereon AI to identify and remediate exploitation attempts. We'll assess your patch posture, hunt for IOCs, and harden your SharePoint environment. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.