---
id: 7291
title: "SharePoint ToolShell – One Request PreAuth RCE Chain"
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/sharepoint-toolshell/"
published_at: "2025-07-24T10:39:00Z"
tags: ["rce", "deserialization", "pre-auth", "sharepoint", "pwn2own", "cve-2025-49704"]
phying_url: "https://phying.com/item/7291"
lang: en
---

# SharePoint ToolShell – One Request PreAuth RCE Chain

## Summary

The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **Published:** 2025-07-24T10:39:00Z
- **Original:** https://blog.viettelcybersecurity.com/sharepoint-toolshell/
- **Phying News:** https://phying.com/item/7291