ToolShell SharePoint Simulation

Since 18 July 2025, several national agencies, CERTs and cybersecurity firms have issued warnings about attacks targeting SharePoint. Microsoft issued urgent advice regarding two serious vulnerabilities, CVE‑2025‑49704 and CVE‑2025‑49706, affecting on-premises SharePoint servers, which are currently under active attack. These two vulnerabilities form part of a very dangerous attack chain known as ToolShell.

As the initial patches released by Microsoft for these vulnerabilities were incomplete, new security patches for CVE-2025-53770 and CVE-2025-53771 have been released.

The ToolShell attack exploited two vulnerabilities:

• CVE-2025-49706 (initial) and CVE-2025-53771 (update) allows an unauthorised attacker to access SharePoint without logging in. Attackers use the «ToolPane.aspx» endpoint with specially crafted HTTP requests and a specific Referer header to bypass authentication. The Kaspersky team managed to bypass the initial fix for CVE‑2025‑49706 by adding just one byte to the exploit’s POST request. They only needed to add a “/” (slash) at the end of the “ToolPane.aspx” path. Further details can be found at https://securelist.com/toolshell-explained/117045/.
  • https://nvd.nist.gov/vuln/detail/CVE-2025-49706
    • CVSS base score: 6.5 (MEDIUM)
  • https://nvd.nist.gov/vuln/detail/CVE-2025-53771
    • CVSS base score: 6.5 (MEDIUM)
• CVE-2025-49704 (initial) CVE-2025-53770 (update) allows an unauthorised attacker to execute arbitrary code remotely (RCE). This is a vulnerability caused by a failure to properly validate XML data. For the first CVE, Microsoft did not fully fix the vulnerability; they merely reduced the risk by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace (thanks to the Kaspersky team’s analysis: https://securelist.com/toolshell-explained/117045/).
  • https://nvd.nist.gov/vuln/detail/CVE-2025-49704
    • CVSS base score: 8.8 (HIGH)
  • https://nvd.nist.gov/vuln/detail/CVE-2025-53770
    • CVSS base score: 9.8 (CRITICAL)

In summary, the first vulnerabilities (49704/49706) were fixed in July 2025, but new methods of exploiting them were discovered, resulting in two new CVEs, 53770 and 53771.

Simplified ToolShell Exploit Chain

The vulnerabilities only affect on-premises versions of Microsoft SharePoint Server. This includes servers running on physical machines and self-managed SharePoint instances in the cloud.

The affected versions of SharePoint are:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016
• SharePoint Server 2010 and 2013 are no longer supported, but Microsoft still lists them as affected. They will not receive updates from Microsoft.

Microsoft states that SharePoint Online in Microsoft 365 is NOT affected.

Several cybercriminal groups from China are exploiting these CVEs. The groups known to be actively exploiting these vulnerabilities are: Linen Typhoon, Violet Typhoon and Storm-2603. They are involved in using web shells, stealing MachineKey keys and spreading Warlock or LockBit ransomware.

The Storm-2603 attack chain, which exploits SharePoint vulnerabilities and results in ransomware
Source: Microsoft (https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)

Microsoft has set out detailed security recommendations on this page: https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities. The article includes a list of Indicators of Compromise (IOCs) from confirmed exploitation cases and queries to identify potential exploitation activities; use these queries in the Microsoft Defender XDR Security Centre.

We also recommend checking the CISA bulletin for detailed recommendations (https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities).

Other detection rules relating to specific detection tools have also been published:

• Eye Security article (https://research.eye.security/sharepoint-under-siege) provide a list of Indicators of Attack (IoAs) for detecting exploitation attempts using CrowdStrike Falcon, Defender for Endpoint and SentinelOne Complete.
• Palo Alto provides XQL queries for Cortex XDR customers to search for signs of exploitation (https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770).

Update on 6 August 2025: CISA has published a Malware Analysis Report (MAR) containing an analysis and associated detection signatures for files linked to Microsoft SharePoint vulnerabilities => https://www.cisa.gov/news-events/alerts/2025/08/06/cisa-releases-malware-analysis-report-associated-microsoft-sharepoint-vulnerabilities

We created a BlackNoise event to simulate this attack behaviours. It sends two web requests with non-functional payloads to simulate the exploitation of CVE-2025-49706 and its new variant, CVE-2025-53771. BlackNoise customers can use our solution to test how well they can detect this attack chain.

The first stage of the attack can be detected in several ways:

• Using Microsoft Defender XDR queries provided by Microsoft
• At network level, using tools such as NDR or IPS/IDS (for example, using Suricata rules)
• Possibly at endpoint level, using a Sigma rule such as the generic example shown alongside it:

Note: Other methods can be used to identify unusual behaviour linked to CVE‑2025‑49704 and CVE‑2025‑53770 (such as Sigma rules, Yara, Sysmon, etc.), particularly to detect suspicious WebShell execution.