ToolShell
- Product
- Microsoft SharePoint Server (on-premises) 2016 / 2019 / Subscription Edition
- CVE
- CVE-2025-53770CVE-2025-53771CVE-2025-49704CVE-2025-49706
- Disclosed
- 2025-07-19
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- On-premises SharePoint Server 2016, 2019 and Subscription Edition before the July 2025 emergency updates (SharePoint Online not affected)
- Fixed
- July 2025 out-of-band updates: KB5002768 (Subscription Edition), KB5002754 (2019), KB5002760 (2016)
Summary
A pre-auth SharePoint chain first shown at Pwn2Own Berlin 2025 (CVE-2025-49706 + CVE-2025-49704). Attackers found bypasses of the July patches (CVE-2025-53771 / CVE-2025-53770) and mass-exploited them as a zero-day in July 2025. Many victims had their ASP.NET machine keys stolen, so they stayed exposed even after patching.
Root cause
Requests to /_layouts/15/ToolPane.aspx with a Referer of /_layouts/SignOut.aspx skipped authentication (spoofing, CVE-2025-49706 / -53771). ToolPane then processed attacker-supplied Web Part markup, leading to unsafe deserialization of untrusted data (CVE-2025-49704 / -53770). Attackers dropped spinstall0.aspx to read ValidationKey/DecryptionKey and forge signed __VIEWSTATE payloads for persistent code execution.
Impact
Unauthenticated RCE on SharePoint servers and theft of machine keys that allow later code execution even after patching.
Detection
IIS logs with POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit and Referer /_layouts/SignOut.aspx; spinstall0.aspx (or similar) in the LAYOUTS directory; w3wp.exe spawning cmd/powershell. Nuclei template CVE-2025-53770.
Mitigation
Install the July 2025 updates, enable AMSI in Full mode, then rotate the ASP.NET machine keys and restart IIS; hunt for web shells.