{"uuid": "1d4fbffc-b2c4-449f-82b6-8dcfed76c43a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53771", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Viettel Cyber Security\", \"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe\\n          deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft\\n          SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704,\\n          and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path.\\n          As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders),\\n          we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.\", \"disclosure_date\": \"2025-07-08\", \"fullname\": \"exploit/windows/http/sharepoint_toolpane_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/sharepoint_toolpane_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/sharepoint_toolpane_rce\", \"references\": [\"CVE-2025-49704\", \"CVE-2025-49706\", \"CVE-2025-53770\", \"EDB-52405\", \"CVE-2025-53771\", \"URL-https://blog.viettelcybersecurity.com/sharepoint-toolshell/\", \"URL-https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/\", \"URL-https://securelist.com/toolshell-explained/\", \"URL-https://www.zerodayinitiative.com/advisories/ZDI-25-580/\", \"URL-https://www.zerodayinitiative.com/advisories/ZDI-25-581/\", \"URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704\", \"URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706\", \"URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770\", \"URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771\", \"URL-https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/\", \"URL-https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/\", \"URL-https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501\", \"URL-https://x.com/codewhitesec/status/1944743478350557232\", \"URL-https://x.com/thezdi/status/1923317597673533552\", \"URL-https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:59.003440Z"}