Critical deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote code execution over the network. The exploit uses POST requests to /_layouts/15/ToolPane.aspx with HTTP Referer header /_layouts/SignOut.aspx to bypass authentication, then extracts MachineKey configuration to generate valid __VIEWSTATE payloads for arbitrary code execution via a single HTTP request.
Research:
PoC:
#ad #sharepoint #deserialization #toolshell #rce
Research: SharePoint 0-day uncovered (CVE-2025-53770)
Eye Security was first in uncovering active exploitation of CVE-2025-53770 affecting on-prem SharePoint deployments globally. Get the latest IOCs and mitigation steps.research.eye.security
PoC:
Sharepoint "0day" payload
Sharepoint "0day" payload. GitHub Gist: instantly share code, notes, and snippets.gist.github.com
#ad #sharepoint #deserialization #toolshell #rce