{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"ToolShell: SharePoint Zero-Day Chain Gives Hackers Full Remote Access","html":"","width":"100%","height":180,"duration":3503,"description":"A new wave of zero-day attacks—collectively known as ToolShell—is actively targeting Microsoft SharePoint servers, with two vulnerabilities (CVE-2025-53770 and CVE-2025-53771) allowing unauthenticated remote code execution and identity control bypass. First observed in high-value targets across government, critical infrastructure, and manufacturing sectors, the ToolShell exploit chain has since expanded into opportunistic attacks, with early attribution pointing to China-linked threat actors.\nThe attack chain begins by exploiting a deserialization flaw and a spoofing/path traversal bug to gain unauthenticated access to SharePoint’s ToolPane functionality. Once inside, attackers deploy stealthy ASPX webshells like xxx.aspx and spinstall0.aspx to exfiltrate cryptographic secrets—including ASP.NET MachineKey values—without triggering alerts. In more advanced cases, attackers avoid persistent shell artifacts altogether, using in-memory modules for fileless exploitation and credential theft.\nThis episode dives into the full lifecycle of the ToolShell attacks:\nHow attackers rapidly evolved their tactics after initial Microsoft patches were released\nWhy SharePoint 2016 users remain at elevated risk due to the absence of a patch\nEvidence of AMSI evasion, SSO and MFA bypasses, and credential harvesting across victim networks\nBest practices for mitigation: patching, enabling AMSI \"Full Mode\", deploying antivirus with EDR, and rotating cryptographic keys\nWhy machine key rotation is essential even post-patching to revoke compromised credentials and prevent persistent access\nWe’ll also discuss the role of SharePoint's layout endpoints, how logging POST requests to /_layouts/15/ToolPane.aspx can reveal exploitation attempts, and why incident response planning and forensic readiness are now non-negotiable for organizations running on-prem SharePoint.\nThe ToolShell campaign is a sobering example of how quickly adversaries can pivot in response to public disclosures—and why...","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}