CVE-2025-53770: SharePoint ToolShell RCE Analysis

Educational material for authorized testing, detection engineering, and incident response only. This article intentionally focuses on vulnerability mechanics, artifacts, and remediation rather than providing an operational exploitation guide.

Executive Summary

ToolShell is the public name for an actively exploited SharePoint Server on-premises attack chain associated with CVE-2025-53770. Microsoft describes the issue as a remote code execution vulnerability affecting on-premises SharePoint Server deployments. SharePoint Online in Microsoft 365 is not affected.

The high-level risk is severe: an unauthenticated attacker can abuse the SharePoint ToolPane processing path to reach code execution, deploy or trigger server-side payloads, steal ASP.NET MachineKey material, and then forge ViewState data that the server accepts as legitimate. Once the MachineKey has been exposed, patching alone is not enough. The keys must be rotated across the farm and IIS must be restarted.

TL;DR

Field	Value
CVE	CVE-2025-53770
Public name	ToolShell
Product	Microsoft SharePoint Server on-premises
Not affected	SharePoint Online in Microsoft 365
Class	Untrusted data deserialization / ViewState abuse
Impact	Remote code execution
Exposure	Internet-facing SharePoint servers are highest risk
Status	Exploited in the wild; added to CISA KEV
Priority actions	Patch, rotate MachineKeys, restart IIS, hunt for compromise

1. Background

SecurityZone summarized ToolShell as a SharePoint RCE issue involving /_layouts/15/ToolPane.aspx, a suspicious Referer value pointing to /_layouts/SignOut.aspx, and ViewState-related unsafe deserialization. The same research thread highlights a common post-exploitation objective: extracting ASP.NET ValidationKey and DecryptionKey values so that later ViewState payloads can be signed or encrypted in a way the target server trusts.

Microsoft later published customer guidance and threat intelligence confirming active exploitation against on-premises SharePoint Server customers. Microsoft also published security updates for supported SharePoint Server versions and explicitly instructed customers to rotate ASP.NET MachineKeys after applying updates.

Related vulnerabilities in the same broader ToolShell context include:

• CVE-2025-49704: SharePoint remote code execution.
• CVE-2025-49706: SharePoint spoofing/authentication-related issue.
• CVE-2025-53770: SharePoint ToolShell RCE variant.
• CVE-2025-53771: related bypass/spoofing issue.

2. Root Cause

The root cause is a broken trust boundary in SharePoint’s handling of attacker-controlled data that reaches the ToolPane and ASP.NET ViewState/Web Part processing paths.

Several mechanics matter:

• /_layouts/15/ToolPane.aspx is a SharePoint page used during Web Part editing and configuration flows.
• DisplayMode=Edit can place the request into a ToolPane-oriented processing path.
• A forged or abnormal Referer value involving /_layouts/SignOut.aspx was observed as part of the authentication-bypass behavior.
• SharePoint/ASP.NET ViewState relies on MachineKey material to protect integrity and, where configured, confidentiality.
• If ValidationKey and DecryptionKey are stolen, an attacker can create ViewState data that passes server-side validation.

The dangerous pattern is not simply “serialization is bad.” The failure is that client-influenced serialized state is treated as trustworthy after the server’s validation assumptions are broken. ToolShell gives attackers a path from unauthenticated request handling into payload processing, then into key theft, and finally into persistent ViewState forgery.

3. ToolShell Execution Flow

The observed attack chain can be understood as a sequence of defensive milestones rather than as a weaponized procedure.

3.1. Initial Targeting

Attackers scan for on-premises SharePoint servers exposed to the internet or reachable from a compromised network segment. Unpatched systems, systems without AMSI Full Mode, and systems without strong edge authentication controls are the most attractive targets.

3.2. ToolPane Request

The initial exploitation activity commonly involves a request to the ToolPane endpoint. Defenders should pay attention to requests where the URI contains /_layouts/15/ToolPane.aspx, the query includes DisplayMode=Edit, and the Referer header points to /_layouts/SignOut.aspx.

This combination is not expected in normal user browsing patterns at scale and is a strong hunting pivot when seen from untrusted sources.

3.3. Deserialization or Dynamic Rendering

After reaching the vulnerable path, the attacker supplies crafted Web Part or ASP.NET control data. Public reporting described payloads that abuse dynamic control rendering or compressed/base64-encoded serialized data. The goal is to make SharePoint process attacker-controlled data as part of server-side page handling.

Depending on the variant, the result can be file creation, server-side script execution, or a more fileless execution path that is harder for simple file integrity monitoring to catch.

3.4. Web Shell or Fileless Payload

Microsoft observed malicious ASPX files written into SharePoint layout directories. The most widely reported name is spinstall0.aspx, but attackers also vary filenames to avoid simple detections.

Observed or expected variants include:

• spinstall0.aspx
• spinstall.aspx
• spinstall1.aspx
• spinstall2.aspx

Some variants avoid a clear dropped file by abusing dynamic rendering. For this reason, defenders should not rely only on filename matching.

3.5. MachineKey Theft

One of the most important post-exploitation objectives is ASP.NET MachineKey extraction. The attacker wants:

• ValidationKey
• DecryptionKey
• validation and decryption algorithm context

With that material, the attacker can forge ViewState that the server accepts as valid. This is why Microsoft’s remediation guidance emphasizes MachineKey rotation after patching.

3.6. Post-Exploitation

After code execution, follow-on activity often appears under the IIS worker process, commonly w3wp.exe.

Defenders should look for:

• w3wp.exe spawning cmd.exe, powershell.exe, or pwsh.exe.
• PowerShell with EncodedCommand, -enc, or -ec.
• Commands referencing spinstall, TEMPLATE\LAYOUTS, or Web Server Extensions.
• Scheduled task creation.
• Suspicious IIS modules or .NET assemblies.
• Attempts to disable Microsoft Defender or modify endpoint protections.
• Credential theft activity such as LSASS access or Mimikatz.
• Lateral movement via PsExec, WMI, or Impacket.
• Ransomware staging or GPO modification in broader compromise cases.

4. Indicators of Compromise

HTTP and IIS Indicators

Hunt for:

• Requests to /_layouts/15/ToolPane.aspx.
• Query strings containing DisplayMode=Edit.
• Referer values containing /_layouts/SignOut.aspx.
• Requests to /_layouts/15/spinstall0.aspx or spinstall*.aspx.
• POST bodies with unusually large compressed or base64-like content.
• ToolPane access from unknown internet sources or unusual geographies.

File Indicators

Review these directories carefully:

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS

File names of interest:

• spinstall0.aspx
• spinstall.aspx
• spinstall1.aspx
• spinstall2.aspx
• IIS_Server_dll.dll
• SharpHostInfo.x64.exe
• xd.exe
• debug_dev.js

Suspicious paths:

• \15\TEMPLATE\LAYOUTS\debug_dev.js
• \16\TEMPLATE\LAYOUTS\debug_dev.js

Hash Indicators

Microsoft published several SHA-256 indicators related to observed activity:

SHA-256	Description
92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514	Hash associated with spinstall0.aspx
24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf	Web shell receiving and executing C2 commands
b5a78616f709859a0d9f830d28ff2f9dbbb2387df1753739407917e96dadf6b0	Web shell using socket/DNS C2 behavior
c27b725ff66fdfb11dd6487a3815d1d1eba89d61b0e919e4d06ed3ac6a74fe94	Web shell using socket/DNS C2 behavior
1eb914c09c873f0a7bcf81475ab0f6bdfaccc6b63bf7e5f2dbf19295106af192	Web shell using socket/DNS C2 behavior
4c1750a14915bf2c0b093c2cb59063912dfa039a2adfe6d26d6914804e2ae928	Observed IIS_Server_dll.dll hash
83705c75731e1d590b08f9357bc3b0f04741e92a033618736387512b40dab060	Observed IIS_Server_dll.dll hash
f54ae00a9bae73da001c4d3d690d26ddf5e8e006b5562f936df472ec5e299441	Observed IIS_Server_dll.dll hash

Network Indicators

Defang these values before sharing them in tickets or chat systems:

• update[.]updatemicfosoft[.]com
• msupdate[.]updatemicfosoft[.]com
• c34718cbb4c6[.]ngrok-free[.]app
• 65.38.121[.]198
• 131.226.2[.]6
• 134.199.202[.]205
• 104.238.159[.]149
• 188.130.206[.]168

Microsoft Defender Alert Names

Microsoft lists several alert titles that may indicate related activity:

• Possible web shell installation
• Possible exploitation of SharePoint server vulnerabilities
• Suspicious IIS worker process behavior
• IIS worker process loaded suspicious .NET assembly
• SuspSignoutReq malware was blocked on a SharePoint server
• HijackSharePointServer malware was blocked on a SharePoint server
• Trojan:PowerShell/MachineKeyFinder.DA!amsi

5. Hunting Ideas

Suspicious File Creation

DeviceFileEvents
| where FolderPath has_any (
    "microsoft shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS",
    "microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS"
)
| where FileName contains "spinstall"
   or FileName contains "spupdate"
   or FileName contains "SpLogoutLayout"
   or FileName contains "SP.UI.TitleView"
   or FileName contains "queryruleaddtool"
   or FileName contains "ClientId"
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, FolderPath,
          ReportId, ActionType, SHA256
| order by Timestamp desc

IIS Worker Process Spawning Shells

DeviceProcessEvents
| where InitiatingProcessFileName has "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
   or ProcessCommandLine has_any ("EncodedCommand", "-enc", "-ec")
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Vulnerable Device Exposure

DeviceTvmSoftwareVulnerabilities
| where CveId in (
    "CVE-2025-49704",
    "CVE-2025-49706",
    "CVE-2025-53770",
    "CVE-2025-53771"
)

6. Remediation and Hardening

Apply Security Updates

Apply the Microsoft security updates for the relevant SharePoint Server version:

• SharePoint Server Subscription Edition: KB5002768.
• SharePoint Server 2019: KB5002754; also install the matching language pack update KB5002753 where applicable.
• SharePoint Server 2016: KB5002760; also install the matching language pack update KB5002759 where applicable.

Rotate ASP.NET MachineKeys

After patching, rotate SharePoint Server ASP.NET MachineKeys across the farm. This step invalidates previously stolen key material.

Microsoft’s documented PowerShell flow is:

Set-SPMachineKey -WebApplication <SPWebApplicationPipeBind>
Update-SPMachineKey -WebApplication <SPWebApplicationPipeBind>
iisreset

Restart IIS on all SharePoint servers after the rotation.

Enable AMSI and Endpoint Protection

Recommended controls:

• Enable SharePoint AMSI integration.
• Use AMSI Full Mode where available.
• Deploy Microsoft Defender Antivirus or an equivalent antivirus solution on every SharePoint server.
• Deploy Microsoft Defender for Endpoint or an equivalent EDR.
• Enable cloud-delivered protection, tamper protection, and EDR block mode where supported.

Reduce Exposure

If immediate patching or AMSI enablement is not possible:

• Temporarily disconnect internet-facing SharePoint servers.
• Place SharePoint behind VPN or an authenticated reverse proxy.
• Use an authentication gateway for untrusted traffic.
• Restrict access to high-risk SharePoint endpoints at the edge.

Incident Response Checklist

If compromise is suspected:

1. Isolate the SharePoint server from the internet and sensitive internal network segments.
2. Preserve IIS logs, ULS logs, Windows Event Logs, EDR telemetry, and copies of suspicious files.
3. Identify the first suspicious ToolPane request and build a timeline around that timestamp.
4. Inspect TEMPLATE\LAYOUTS, IIS modules, services, scheduled tasks, and startup locations.
5. Patch SharePoint and rotate MachineKeys.
6. Restart IIS across the farm.
7. Rotate exposed credentials, especially service accounts and administrator accounts used on the SharePoint server.
8. Hunt for lateral movement to domain controllers, SQL servers, file servers, and administrator workstations.
9. Review GPO changes and ransomware staging indicators.

7. MITRE ATT&CK Mapping

Tactic	Technique	Description
Initial Access	T1190	Exploit public-facing application
Execution	T1059.001	PowerShell execution
Execution	T1059.003	Windows Command Shell
Persistence	T1505.003	Web shell
Persistence	T1505.004	IIS components
Persistence	T1053.005	Scheduled task
Defense Evasion	T1562.001	Disable or modify security tools
Credential Access	T1003.001	LSASS memory dumping
Lateral Movement	T1570	Lateral tool transfer
Collection	T1119	Automated collection
Command and Control	T1090	Proxy
Impact	T1486	Data encrypted for impact

Conclusion

ToolShell is dangerous because it turns a SharePoint request-handling flaw into a durable compromise path. The attacker does not merely want code execution; they want the cryptographic material that lets them continue forging trusted ViewState payloads.

For defenders, the minimum response is:

• Apply the relevant SharePoint security update.
• Rotate ASP.NET MachineKeys.
• Restart IIS on every SharePoint server.
• Hunt for web shells, suspicious ToolPane requests, w3wp.exe child processes, and MachineKey theft.
• Investigate persistence and lateral movement if any indicator is found.

If an internet-facing SharePoint server was exposed before remediation, treat it as a possible incident and perform full threat hunting rather than relying only on patch status.

References

• SecurityZone: ToolShell: Remote Code Execution in Microsoft SharePoint CVE-2025-53770
• Microsoft MSRC: Customer guidance for SharePoint vulnerability CVE-2025-53770
• Microsoft Security Blog: Disrupting active exploitation of on-premises SharePoint vulnerabilities
• Microsoft Support: Description of the security update for SharePoint Server 2019: July 21, 2025 (KB5002754)
• CISA: CISA Adds CVE-2025-53770 ToolShell to KEV Catalog