ToolShell on SharePoint: CVE-2025-49704/49706 and Patch Bypasses CVE-2025-53770/53771

Summary

A wave of active attacks has hit on-premises Microsoft SharePoint Server using a chain now widely referred to as ToolShell. The chain combines a spoofing bug (CVE-2025-49706) with a remote code execution bug (CVE-2025-49704). Microsoft later disclosed patch bypasses—CVE-2025-53770 (related to 49704) and CVE-2025-53771 (related to 49706)—and shipped comprehensive security updates. SharePoint Online (Microsoft 365) is not affected. (Microsoft)

Microsoft and CISA both confirm in-the-wild exploitation, with guidance to apply the latest updates, enable AMSI in Full Mode, rotate ASP.NET machine keys, and restart IIS. Multiple threat actors, including state-linked groups, have used this chain; some intrusions culminated in ransomware deployment. (Microsoft, CISA)

Affected Products & Fixed Releases

Updates are cumulative—installing the latest supersedes earlier ones. After patching, rotate machine keys and restart IIS. (Microsoft Security Response Center, Microsoft)

What Are These CVEs?

• CVE-2025-49704 — RCE: Enables code execution on vulnerable on-prem SharePoint servers. Widely chained with 49706. (CISA)
• CVE-2025-49706 — Spoofing: Network spoofing that helps pivot into the RCE path. (CISA)
• CVE-2025-53770 — Patch bypass (RCE-related): Newer issue related to 49704; Microsoft confirms comprehensive updates now address it. (Microsoft, NVD)
• CVE-2025-53771 — Patch bypass (path traversal / security bypass): Related to 49706; covered by the July comprehensive updates. (Microsoft)

CISA added these to KEV and published a MAR with web-shell and TTP details, underscoring real-world impact. (CISA)

How ToolShell Attacks Unfold (at a glance)

1. Initial access via crafted requests to SharePoint endpoints (e.g., ToolPane).
2. Auth bypass + RCE chain (49706 → 49704), often dropping a web shell.
3. Post-exploitation: Exfiltrate ASP.NET machine keys, disable defenses, run encoded PowerShell from w3wp.exe, then lateral movement.
4. Impact: From content theft to Warlock ransomware in some cases. (Microsoft)

Non-Exploit Validation Playbook (Safe for Blue Teams)

Use the steps below to verify risk and hunt for compromise without attempting exploitation.

1) Confirm Patch State

• Inventory on-prem SharePoint farms; verify KB5002768 / KB5002754+2753 / KB5002760+2759 present.
• Ensure you applied the latest cumulative updates (July 2025 or later). (Microsoft Security Response Center)

2) Enable/Verify AMSI in Full Mode

• Confirm AMSI integration is on and Full Mode enabled for SharePoint 2016/2019/Subscription Edition. If AMSI cannot be enabled, consider temporarily removing internet exposure until patched. (Microsoft Security Response Center, Microsoft)

3) Rotate Keys and Restart IIS

• Rotate ASP.NET machine keys across the farm, then iisreset on all SharePoint servers. Repeat after patch if AMSI wasn’t enabled earlier. (Microsoft Security Response Center, Microsoft)

4) Hunt for Known IOCs (paraphrased from Microsoft)

Look for suspicious .aspx web shells and PowerShell activity tied to SharePoint worker processes:

• Files: any variant of spinstall0.aspx (and similar names) under ...\Web Server Extensions\15/16\TEMPLATE\LAYOUTS\.
• Processes: w3wp.exe spawning cmd.exe then powershell.exe with base64-encoded commands.
• Network: POSTs to /_layouts/15/ToolPane.aspx?DisplayMode=Edit, and any unusual referrer patterns such as /_layouts/SignOut.aspx. Use your SIEM/XDR to filter by server path, parent process, base64 indicators, and endpoint alerts flagged by your EDR. (Microsoft, CISA)

5) EDR/AV Detections

Microsoft documents several Defender detection names for this campaign. Map them to your toolset or create equivalent detections for suspicious sign-out request bodies, machine-key access attempts, and SharePoint worker anomalies. (Microsoft Security Response Center)

Rapid Hardening Checklist

• Patch now: Apply the latest July 2025 comprehensive updates for your SharePoint version. (Microsoft)
• AMSI Full Mode: Enable and verify—this blocks unauthenticated exploit attempts Microsoft observed. (Microsoft)
• Rotate keys: Rotate ASP.NET machine keys and restart IIS across all SharePoint servers. (Microsoft Security Response Center)
• Purge malicious modules: Before restarting IIS, remove any malicious module entries from applicationHost.config/web.config. (CISA)
• Hunt and clean: Search for *spinstall.aspx\ variants and related encoded PowerShell activity; eradicate persistence. (Microsoft)
• Reduce exposure: If AMSI can’t be enabled immediately, take public-facing servers off the internet until fully remediated. (Microsoft Security Response Center)

Why This Matters

This is a multi-stage, repeat-exploited attack path against collaboration infrastructure that often straddles crown-jewel data. Even after patching, stolen machine keys can enable ongoing impersonation if not rotated—so treat key rotation as non-negotiable alongside updates. (Microsoft Security Response Center, Microsoft)

Role of Cert-X-Gen (How we help)

Our approach for clients running on-prem SharePoint:

• Behavioral fingerprinting of ToolShell-like requests and post-exploitation patterns.
• Automated hygiene checks: patch level, AMSI mode, and key-rotation drift.
• IOC sweeps for suspicious LAYOUTS-path files and w3wp.exe → cmd → powershell chains.
• Ransomware path disruption: alerting on tampering with Defender, LSASS access, and lateral-movement tooling.

This is defensive validation—no exploit traffic—built to confirm you’re safe without adding risk.

Timeline

• July 19, 2025 — MSRC publishes customer guidance; confirms on-prem only impact. (Microsoft Security Response Center)
• July 22–23, 2025 — Microsoft threat intel blog details ToolShell activity, actors, IOCs, and mitigations. (Microsoft)
• July 24–Aug 6, 2025 — CISA updates alert repeatedly, adds MAR and KEV entries, highlights ransomware cases, and prescribes hunting guidance. (CISA)

References

• MSRC: Customer guidance for SharePoint vulnerability CVE-2025-53770/53771. (Microsoft Security Response Center)
• Microsoft Security Blog: Disrupting active exploitation of on-premises SharePoint vulnerabilities. (Microsoft)
• CISA Alert: Guidance and MAR on ToolShell exploitation. (CISA)
• NVD: CVE-2025-53770 details (RCE; exploit exists in the wild). (NVD)
• Unit 42 Analysis: Overview of the ToolShell chain and impact. (Unit 42)

---

Need help verifying your farm is clean and correctly hardened? Bugb can run a safe, read-only validation pass and deliver a fix list tailored to your environment.

• IT Pro
• The Times of India
• windowscentral.com