The module, designated as pull request #20409 in the Metasploit Framework repository, addresses CVE-2025-53770 and CVE-2025-53771, which enable unauthenticated remote code execution (RCE) attacks against vulnerable SharePoint installations. During testing, the module successfully compromised a Windows Server 2022 system running SharePoint Server 2019 version 16.0.10417.20027, establishing a Meterpreter session within the c:\windows\system32\inetsrv directory. Testing revealed that some SharePoint configurations with authentication requirements may need endpoint adjustments from error.aspx to start.aspx for successful exploitation verification. The active exploitation of these vulnerabilities, combined with their unauthenticated nature, presents significant risks to enterprise environments running affected SharePoint versions. The exploit specifically targets the /_layouts/15/ToolPane.aspx endpoint, leveraging a deserialization vulnerability to achieve code execution with SYSTEM privileges. Current module options include configurable target hosts (RHOSTS), ports (RPORT), SSL negotiation, and proxy support through various protocols, including SOCKS4, SOCKS5, and HTTP. Initial patch attempts through KB5002741 implemented path validation checks for ToolPane.aspx endpoints, but the new exploit successfully bypasses these protections. The payload delivery mechanism supports multiple fetch commands, including CERTUTIL, CURL, and TFTP, with automatic cleanup capabilities to remove artifacts after execution. SharePoint vulnerabilities (CVE-2025-53770/53771) exploited in the wild via a single HTTP request. The newly identified vulnerabilities represent sophisticated patch bypasses for previously disclosed security flaws CVE-2025-49704 and CVE-2025-49706. The exploit utilizes the Msf::Util::DotNetDeserialization routines to construct malicious payloads, replacing the original base64-encoded gadget chain discovered in wild attacks.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 24 Jul 2025 11:35:11 +0000