SharePoint under fire: new ToolShell attacks target enterprises
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-49704 +1 in the same advisory: …49706 | Authenticated Code Injection RCE in Microsoft SharePoint CVE-2025-49704 is a code injection vulnerability (CWE-94) in Microsoft SharePoint that allows an authorized (authenticated) attacker to execute arbitrary code on the server over the network, by sending requests whose attacker-controlled input SharePoint executes as code. It can be chained with CVE-2025-49706, and Microsoft subsequently issued CVE-2025-53770 as a patch bypass of the original CVE-2025-49704 fix, meaning the CVE-2025-53770 updates provide stronger protection and should be treated as the definitive remediation. Successful exploitation yields remote code execution on the SharePoint server, and CISA added the flaw to the KEV on 2025-07-22 with known ransomware use. Organizations running on-premises SharePoint Server are affected; CISA directs owners of public-facing servers running EOL/EOS versions (SharePoint Server 2013 and earlier) to disconnect them, and operators of supported versions to apply the CISA and vendor mitigations and updates, with cloud SharePoint services governed by BOD 22-01. Exploitation is confirmed in the wild and EPSS assigns a 100% probability of exploitation within 30 days (top percentile), although no public proof-of-concept code is documented. Do: Apply Microsoft's SharePoint Server updates for CVE-2025-53770, which supersede the original CVE-2025-49704 fixes with more robust protection, prioritizing internet-facing servers. Disconnect public-facing SharePoint servers running EOL/EOS versions (SharePoint Server 2013 and earlier), and for supported versions follow the CISA and vendor mitigations, with cloud services handled per BOD 22-01. Because in-the-wild exploitation and ransomware use are confirmed, hunt for indicators of compromise and ransomware activity on exposed SharePoint servers. | 8.8 group max | 100% | KEV ransomware |
| masstens of thousands of internet-exposed SharePoint servers per public scans, within a total on-premises install base plausibly exceeding 100,000 deployments… | |
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises CVE-2025-53770 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server on-premises that allows an unauthorized attacker to execute code over a network. It is triggered when the server deserializes attacker-controlled data, can be chained with CVE-2025-53771, and it bypasses the fixes issued for CVE-2025-49704, meaning the earlier patches are insufficient. Successful exploitation yields remote code execution on the SharePoint server, and ransomware operators are known to be using it. Any organization running SharePoint Server on-premises is affected, particularly internet-facing deployments and end-of-life versions such as SharePoint Server 2013 and earlier that can no longer be patched. The flaw is being actively exploited — it was added to CISA's KEV on 2025-07-20 with known ransomware use — and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's updated SharePoint Server security updates that fix CVE-2025-53770 — these include more robust protection than the earlier CVE-2025-49704 updates — and ensure the companion CVE-2025-53771 is also addressed, following CISA and vendor mitigation instructions for supported versions. Disconnect public-facing SharePoint Server 2013 or earlier (EOL/EOS) instances, minimize internet exposure of supported servers, and hunt for signs of compromise given the known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×3 |
| mass≈25,000–100,000 internet-exposed on-premises SharePoint servers (public internet-wide scans); total on-prem installed base plausibly >1M users |
Full article620 words · extracted from securityaffairs.com · click to collapse
While SentinelOne did not attribute the attack to a specific threat actor, The Washington Post linked it to China-nexus acors.
On July 19, Microsoft confirmed active exploitation of a zero-day vulnerability, tracked as CVE-2025-53770 in on-prem SharePoint Servers. The IT giant issued emergency patches for SharePoint Subscription Edition and 2019, with 2016 updates pending. Microsoft urges customers to immediately patch the vulnerability.
SentinelOne observed attacks on July 17 and identified three attack clusters with different tactics, while the attribution remains ongoing.
CVE-2025-53770 (ToolShell) exploit was initially used in targeted attacks against high-value organizations in sectors like tech consulting, manufacturing, critical infrastructure, and professional services tied to sensitive engineering and architecture. After public disclosure, the activity shifted to more opportunistic exploitation, with both nation-state actors and financially motivated actors attempting to exploit unpatched systems. Some actors are even setting up honeypots to test exploits and sharing tools and techniques across known underground platforms.
The ToolShell attack chain combines two previously patched SharePoint flaws (CVE-2025-49704 and CVE-2025-49706) that were demonstrated at Pwn2Own Berlin. It allows unauthenticated remote code execution by exploiting a logic flaw in SharePoint’s ToolPane page. Attackers use a crafted POST request to bypass authentication and run code via uploaded web components.
On July 18, 2025, SentinelOne researchers observed an attacker dropping a custom, password-protected ASPX webshell (xxx.aspx) to the SharePoint LAYOUTS directory. The shell enabled authentication, command execution, and file upload via basic HTML interfaces and used SHA512 hashing for access control. The actor tested it by executing a whoami command and saving output to a .js file.
Additionally, a second webshell (spinstall0.aspx) was observed in two attack waves on July 18–19. Both deployed the same payload, designed to extract sensitive cryptographic data. The attacks appeared manual, exploratory, and likely part of broader, ongoing preparations.
Between July 17 and 19, 2025, the researchers observed three distinct ToolShell exploitation waves, each with unique methods and goals:
First Wave (July 18):
From IP 107.191.58[.]76, attackers used PowerShell to deploy a base64-decoded payload (spinstall0.aspx) to the SharePoint LAYOUTS directory. This webshell wasn’t used for command execution but harvested MachineKey values—critical for forging authentication tokens and maintaining access in load-balanced environments.
Second Wave (July 19):
From IP 104.238.159[.]149, attackers repeated the same payload deployment, altering the directory path to target a different SharePoint version. Again, spinstall0.aspx extracted cryptographic secrets for persistence, not command execution.
“No Shell” Cluster (July 17–18):
From IP 96.9.125[.]147, this earliest and stealthiest wave used in-memory .NET module execution without writing files to disk. Attackers delivered encoded payloads and executed them dynamically via PowerShell or .NET reflection, making detection difficult. This fileless approach suggests a highly skilled red team or nation-state actor focused on stealth and credential harvesting.
All clusters targeted high-value SharePoint deployments, with a clear emphasis on persistence and access via cryptographic key theft, rather than immediate system control.
“Modern threat actors are maximizing gains from patch diffing, n-day adoption, and iterative development of exploits through fast adoption. SharePoint servers are attractive to threat actors for the high likelihood that they store sensitive organizational data.” concludes SentinelOne. “Beyond their value as a knowledge store, vulnerable SharePoint servers can be used to stage and deliver additional attack components to the victim organization for internal watering hole attacks. The ease of exploitation and potential value of the data hosted on these servers make ‘ToolShell’ a potent and dangerous attack chain.”
While SentinelOne did not attribute the attack to a specific threat actor, The Washington Post, citing its source, reported that the attacks targeted SharePoint servers were likely conducted by unnamed China-linked threat actors.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, China)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/180252/hacking/sharepoint-under-fire-new-toolshell-attacks-target-enterprises.html