Semi-controversial thoughts on the recent
#SharePoint patch & CVE-2025-53770 (ToolShell or ToolPain 🥸):
🪟On Microsoft’s effort:
I now believe MS genuinely tried to fix a flawed patch over the weekend before it was exploited by APTs. But several things went wrong beforehand:
- The initial patch left known bypasses which could have been avoided by a bit of testing.
- The original Defender workaround could also be bypassed.
- MS must have known about the ExcelData gadget since at least 2020:
srcincite.io/blog/2020/07/20…
but didn’t block it proactively.
- SP still relying on a blocklist that might be bypassed.
⌛️On exploitation of CVE-2025-53770:
I haven’t seen credible signs the new variant was exploited before the second patch.
I know the bypass chain, and none of the public payloads would have worked after the first patch.
🗞️On inaccurate information:
This blog post is misleading imho:
research.eye.security/sharep…
- It has used CVE-2025-53770 instead of CVE-2025-49704. Anyone reading that blog post would think the new variants were being exploited too.
- CVE-2025-49706 (auth check bypass) and its variant, CVE-2025-53771, won't do any good without the deserialization gadget afaik.
- It doesn't explain that attackers do not need to write a file to exploit this. Although it is obvious to technical folks, it may not be so obvious to others especially if we are giving advice.
- MS remains quiet on whether the vuln was exploited before the first patch. It would have been much better if MS could clear the water.
👎On the fallout: This will likely backfire on some researchers and vendors again due to inaccurate media hype even though this was a real N-day by the looks of it.
The part bypassing ParseAssemblyQualifiedName is difficult to be figured out quickly after the patch though; perhaps there are some smart people amongst bad guys too.
🤥On GitHub noise and our community:
GitHub is full of AI-generated or miscategorized PoCs for this vuln - e.g.
github.com/kaizensecurity/CV…
We as a infosec/cybersec community should be better than this. Many of us went after the credit without actually adding much value in addition to what was published already.
I for one thought the bypasses are also being exploited too at some point last week (it was hard to verify them with all the noise and limited access to a working lab).
I salute those amongst us who keep calm and keep the world safer - no headlines, no ego, just consistent work that makes a real difference.🫡
Does anyone have a payload for CVE-2025-53770 (toolshell ), I have a feeling that what we have seen so far are related to CVE-2025-49704, and CVE-2025-53770 has not been exploited by malicious actors. Please prove me wrong!
I'm not interested in the auth bypass part btw.