SharePoint “ToolPane / ToolShell” Exploit Chain

Why do we care ?

Because SharePoint sits at the centre of many organisations’ Microsoft ecosystems - hosting sensitive documents, workflows, and authentication tokens - an attacker who breaches it gains an instant bridgehead inside the network. Compromise often yields domain credentials, stored files, and the ability to run code as the web-app service account, which can pivot to Domain Admin or launch ransomware. In short, successful exploitation is not just a “website defacement” risk; it’s a fast-track to data theft, lateral movement, and full environment takeover - making rapid patching and hardening critical.

Quick Action Points

Microsoft has released security updates for all affected SharePoint versions. Organisations are strongly urged to apply these patches immediately. In addition to patching, Microsoft and CISA recommend the following mitigations:

• Enable Antimalware Scan Interface (AMSI) integration for SharePoint.

• Deploy Microsoft Defender for Endpoint or an equivalent endpoint detection and response (EDR) solution.

• Rotate ASP.NET machine keys.

• Isolate public-facing SharePoint servers until they can be patched and secured.

Given the active and widespread exploitation of these vulnerabilities, organisations with on-premises SharePoint deployments are at immediate risk and should prioritise these mitigation and remediation efforts.

Active Exploit Activity (Updated 4th August 2025)

July 2025: "ToolShell" Exploit Chain and Active Exploitation

In July 2025, a critical series of vulnerabilities in on-premises Microsoft SharePoint Servers came under active and widespread exploitation. The initial attack, dubbed "ToolShell," chains together two vulnerabilities discovered at the Pwn2Own Berlin competition in May 2025:

• CVE-2025-49706: An authentication bypass vulnerability in SharePoint's ToolPane.aspx.

• CVE-2025-49704: A code injection vulnerability allowing an attacker with Site Owner privileges to execute arbitrary code.

This exploit chain allows unauthenticated attackers to achieve remote code execution (RCE) on vulnerable SharePoint servers.

Zero-Day Exploitation and New Vulnerabilities

Shortly after Microsoft released patches for the initial "ToolShell" vulnerabilities, a new zero-day vulnerability, CVE-2025-53770, was discovered being actively exploited in the wild. This vulnerability, a variant of CVE-2025-49704, is a critical deserialization of untrusted data flaw with a CVSS score of 9.8, allowing unauthenticated RCE. A related bypass vulnerability, CVE-2025-53771 (a bypass for CVE-2025-49706), was also disclosed.

Threat Actors and Campaigns

Multiple threat actors have been observed exploiting these vulnerabilities:

• Nation-State Actors: Microsoft has attributed the initial wave of attacks to two Chinese nation-state actors, Linen Typhoon and Violet Typhoon. These groups were observed engaging in espionage and reconnaissance activities as early as July 7, 2025.

• Ransomware Groups: A previously unknown hacking group has been observed deploying 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware, against vulnerable SharePoint servers. Another China-based actor, Storm-2603, has been observed deploying Warlock and Lockbit ransomware. This indicates that the vulnerabilities are being exploited by both state-sponsored and financially motivated actors.

Impact and Scale of Attacks

The "ToolShell" exploit and the subsequent zero-day have been used in a large-scale campaign affecting organisations globally, including government entities, schools, healthcare providers, and large enterprises. Attackers have been observed stealing cryptographic keys, deploying web shells for persistent access, and executing commands to move laterally within compromised networks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-53770 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the severity of the threat.

Snapshot (25 July 2025)

What the exploit is

“ToolPane/ToolShell” is an unauthenticated remote-code-execution chain that:

1. Bypasses authentication (CVE-2025-49706 / 53771) using a crafted request to pages such as ToolPane.aspx/.

2. Uploads a compressed .NET DataSet blob via the hidden field MSOTlPn_DWP, abusing the ExcelDataSet control (CVE-2025-49704 / 53770).

3. Deserialises the blob inside w3wp.exe, spawning PowerShell, MSBuild or rundll32 to drop web-shells.

4. Extracts the server’s MachineKey, letting the attacker mint valid ViewState payloads for persistence and lateral movement.

Microsoft shipped emergency patches on 19-20 July, but the vulnerability had been exploited in the wild since at least 18 July.

---

How widespread is it ?

Are unpatched servers still out there?

Daily telemetry from Censys and GreyNoise shows steady scanning traffic for ToolPane.aspx and ComponentPicker.aspx, and Zscaler reports “tens of thousands of vulnerable services still online” despite the patch’s availability. With public proof-of-concept code circulating, opportunistic actors are mass-exploiting any stragglers they find.

CVE List

Note: NVD records for CVE-2025-49704 and CVE-2025-49706 were added on 22 July 2025, but the vulnerabilities were originally disclosed and patched in the regular July 8 Patch Tuesday release, so the earlier Microsoft dates are shown above for defender context.

Attack Stages

Mitigation checklist - “ToolShell” findings

1. Patch immediately to the July 20 2025 cumulative (Microsoft.SharePoint.dll ≥ 16.0.10417.20037).

2. Run the SharePoint Products Configuration Wizard (or PSConfig) after installing any July 8 updates; this is required to mark ExcelDataSet as unsafe and fully close CVE‑2025‑49704.

3. Assume compromise if exposed pre‑patch:

   1. Take server offline & update.

   2. Rotate MachineKeys → IISRESET /STOP → reboot → rotate again.

4. Log & IOC sweep:

   • Requests to ToolPane.aspx/, ComponentPicker.aspx, spoofed Referer headers.

   • Large / high‑entropy payloads in MSOTlPn_DWP, __VIEWSTATE, __REQUESTPAYLOAD.

   • New .aspx / .gif named spinstall, spworker, debug_dev, diag, etc.

5. Hardening:

   • Enable AMSI Full Mode and an EDR with behaviour detection (e.g. verdicts like PDM:Exploit.Win32.Generic).

   • Place a WAF in front of SharePoint; block editing endpoints unless truly required.

   • Restrict outbound internet from SharePoint servers.

6. Persistence hunt:

   • Scheduled tasks named “Update‑SharePoint”, “Diag‑Service”, etc.

   • Unexpected IIS modules/handlers in applicationHost.config.

   • New local or domain admins created after 2025‑07‑08.

7. If ransomware or data theft is suspected: engage IR, rotate all SQL / service‑account / certificate secrets and rebuild from a trusted image.

Further reading