Microsoft SharePoint Zero-Day Exploitation Campaign (CVE-2025-53770, CVE-2025-53771)
Source: TheHackerNews, Dark Reading, CSO Magazine, Krebs on Security
• July 18, 2025 (6:00 PM CET): Active exploitation begins
• July 20, 2025: CISA adds CVE-2025-53770 to Known Exploited Vulnerabilities catalog
• July 21, 2025: Microsoft releases emergency patches for both vulnerabilities
/_layouts/15/ToolPane.aspx with spoofed Referer headers.Indicators of Compromise (IOCs):
spinstall0.aspx- Malicious ASPX payload file- POST requests to
/_layouts/15/ToolPane.aspx - Spoofed Referer header:
_layouts/SignOut.aspx - PowerShell execution for MachineKey extraction
- Anomalous SharePoint service restarts
• CVE-2025-53770 (CVSS 9.8): Remote code execution via deserialization of untrusted data in SharePoint Server
• CVE-2025-53771 (CVSS 7.1): Spoofing vulnerability enabling path traversal in SharePoint
• CVE-2025-49706 (CVSS 6.3): Authentication bypass vulnerability (chained)
• CVE-2025-49704 (CVSS 8.8): Code injection vulnerability (chained)
• T1190 (Initial Access): Exploit Public-Facing Application
• T1059.001 (Execution): PowerShell execution for credential harvesting
• T1505.003 (Persistence): Web Shell deployment via ToolShell backdoor
• T1552.004 (Credential Access): Private Keys extraction (ASP.NET MachineKey)
• T1021.001 (Lateral Movement): Remote Services via compromised SharePoint integration
Analysis: This represents a critical supply chain attack targeting enterprise collaboration infrastructure. The sophistication of vulnerability chaining demonstrates advanced threat actor capabilities with deep understanding of SharePoint architecture. The theft of ASP.NET machine keys enables persistent access and lateral movement across integrated Microsoft services (Teams, OneDrive, Outlook). Organizations with internet-facing SharePoint servers should assume compromise and implement immediate containment measures.
For more breach intelligence reports and cybersecurity insights, visit CISOPlatform.com and sign up to be a member.
Nominate for Global CISO 100 Awards & Future CISO Awards (1-2 October Atlanta, USA): Nominate Your Peer
Comments