---
title: "SharePoint ToolShell (CVE-2025-53770)"
canonical: https://trickest.com/library/sharepoint-rce-check-cve-2025-53770
description: "Point hosts at SharePoint and flag CVE-2025-53770 by version, then confirm with a ToolPane GET and a SignOut referer. No ViewState gadget. CISA KEV."
---

# SharePoint ToolShell (CVE-2025-53770)

## Overview

This workflow finds Microsoft SharePoint Server and sorts each host by whether its version falls in the CVE-2025-53770 range. CVE-2025-53770 is unauthenticated ToolPane access that leads to ViewState deserialization. Confirm only checks that the edit pane answers. It does not deserialize. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from a public page, reads the version from the MicrosoftSharePointTeamServices header when present, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). Version flag is first. Hosts in range get a second node that GETs ToolPane with a SignOut referer. It does not send a ViewState gadget.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as SharePoint, then read the version and compare it to the CVE-2025-53770 floors in the graph.
3. Confirm only those flagged hosts with an unauthenticated GET of `/_layouts/15/ToolPane.aspx` and a SignOut referer. It does not send a ViewState gadget.
4. Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether SharePoint was detected, the version read, the affected flag, and whether the ToolPane surface answered.
- **summary.json.** Counts across the list: targets, product hits, affected, confirmed, and errors.

## Integrations

- HTTP. Unauthenticated GET to the product surface and, on flagged hosts only, ToolPane with a SignOut referer. No ViewState gadget.

## Sample output

The records below are illustrative and do not come from a real run. They show one SharePoint host inside the CVE-2025-53770 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://sp.example.com", "product_detected": true, "version": "16.0.18526.20172", "affected": true, "error": null}
{"target_url": "https://sp.example.org", "product_detected": true, "version": "16.0.18526.20410", "affected": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "error": "not_product"}
```

```json
{"cve": "CVE-2025-53770", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which SharePoint versions does this flag?

On-prem SharePoint Server builds before the July 2025 ToolShell patches. The MicrosoftSharePointTeamServices header is the version source when present. The compare uses the version the product itself served.

### Does a confirmed row mean ToolShell RCE?

No. Confirm only GETs ToolPane with a SignOut referer. It does not send a ViewState gadget. A confirmed row means the edit pane still answers.

### Is this check safe on production?

Yes. Fingerprint is read-only GET. Confirm is an unauthenticated ToolPane GET, only on hosts already in range. It does not log in or deserialize.

### Does the check need credentials?

No. It fingerprints the public page the way an external scanner would.

### What is CVE-2025-53770?

Unauthenticated ToolPane access that leads to ViewState deserialization. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms that ToolPane still answers.

## Related workflows

- [Confluence Authz (CVE-2023-22518)](/library/confluence-authz-check-cve-2023-22518). Reach for it when the next host is a wiki, not SharePoint.
- [Ivanti Auth Bypass (CVE-2023-46805)](/library/ivanti-auth-bypass-check-cve-2023-46805). Reach for it when the next host is a VPN gateway.
- [TeamCity Auth Bypass (CVE-2024-27199)](/library/jetbrains-teamcity-auth-bypass-cve-2024-27199). Reach for it when the next host is a CI server.

---
_Markdown source of https://trickest.com/library/sharepoint-rce-check-cve-2025-53770._