Critical deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote code execution over the network. The exploit uses POST requests to
/_layouts/15/ToolPane.aspx with HTTP Referer header /_layouts/SignOut.aspx to bypass authentication, then extracts MachineKey configuration to generate valid __VIEWSTATE payloads for arbitrary code execution via a single HTTP request.🔗 Research:
https://research.eye.security/sharepoint-under-siege/
🔗 PoC:
https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501
🔗 Exploit:
https://github.com/soltanali0/CVE-2025-53770-Exploit
#ad #sharepoint #deserialization #toolshell #rce