PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SharePoint ToolShell – One Request PreAuth RCE Chain

blog.viettelcybersecurity.com | vulnerability | #rce | #deserialization | #pre-auth | #sharepoint | #pwn2own | #cve-2025-49704
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass
Breakdown of CVE-2026-65660, a SafeControls type-check bypass in SharePoint. It shows an in-memory webshell technique chaining into pre-auth RCE, affecting all versions through Subscription Edition.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE
CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
vulnerability · blog.viettelcybersecurity.com
Phân tích CVE-2026-20963
A diff-based analysis of SharePoint CVE-2026-20963 shows the KB5002825 patch hardened Register Directive parsing, which attackers could abuse to bypass SafeControls checks and reach RCE.
vulnerability · blog.viettelcybersecurity.com
[CVE-2025-49704] ToolShell - A Critical SharePoint Vulnerability Chain under Active Exploitation
Viettel dissects the ToolShell SharePoint chain—CVE-2025-49704 deserialization RCE and CVE-2025-49706 auth bypass—actively exploited, with patch bypasses CVE-2025-53770/53771 and hunting guidance.
vulnerability · blog.viettelcybersecurity.com
SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization
CVE-2024-38018: SPSerializationBinder allowed binary deserialization of SafeControls classes via WebPart attached properties, enabling RCE with a crafted ysoserial payload.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-22005 Microsoft Sharepoint RCE
Patch analysis of CVE-2022-22005, an RCE in Microsoft SharePoint (CVSS 8.8): diffing SharePoint 2016 builds pinpoints unsafe deserialization in ChartPreviewImage.loadChartImage().
Back