Active Exploitation of Microsoft SharePoint Vulnerabilities ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
• Blog Title: Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief
• Suggested Section: generic-hacking/sharepoint-exploitation.md

🎯 Content Summary

Executive Summary

Unit 42 observed active exploitation of on-premises Microsoft SharePoint vulnerabilities CVE-2025-49704 (code injection, CVSS 8.8), CVE-2025-49706 (improper authentication, CVSS 6.3), CVE-2025-53770 (unauthenticated deserialization RCE, CVSS 9.8) and CVE-2025-53771 (path traversal spoofing, CVSS 6.3) on SharePoint Server 2016, 2019 and Subscription Edition. Attackers bypass MFA/SSO, execute commands...

🔧 Technical Details

SharePoint Exploitation Chain (ToolShell): Attackers chain CVE-2025-49704’s code injection with CVE-2025-49706’s improper authentication, CVE-2025-53770’s unauthenticated deserialization RCE and CVE-2025-53771’s path traversal by sending crafted HTTP requests to /_layouts/15/ToolPane.aspx, bypassing MFA/SSO and triggering w3wp.exe to execute unauthorized commands.

Web.config Exfiltration: By spawning cmd.exe from w3wp.exe, attackers execute a...

🤖 Agent Actions

Added comprehensive Microsoft SharePoint exploitation guidance and linked it within Web tech tricks list.

Key updates:

1. Created src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md
   • Summarises enumeration, 2025 CVE exploit chain (code-injection, auth bypass, unauthenticated ViewState deserialization & path-traversal).
   • Provides post-exploitation recipes (web.config exfiltration, Base64 web-shell, obfuscated variant).
   • Adds detection & mitigation sections plus cross-references to IIS and ViewState deserialization pages.
   • Includes full reference section with Unit42 blog and advisories.

2. Modified src/network-services-pentesting/pentesting-web/README.md
   • Added “Microsoft SharePoint” entry in the Web tech tricks list pointing to the new page....

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/sharepoint-exploitation.md".

Repository Maintenance:

• MD Files Formatting: 857 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge