CVE-2025-49704
Analyzed
Published: 08 Jul 2025, 17:15
Last modified:30 Jul 2025, 01:00
Vulnerability Summary
Overall Risk
Critical Risk
88/100 CVSS Score
8.8 HIGH
v3.1
EPSS Score
66.1% CRITICAL
98%ile 0.00%
CISA KEV
Active
Ransomware
Known Use
Exploits
1 found
Dark Web
Not detected
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Source Identifier: secure@microsoft.com
| CVSS | Source | Severity | Exploitability | Impact | Vector |
|---|---|---|---|---|---|
| v4.0 | n/a | ||||
| v3.1 | secure@microsoft.com | 8.8 HIGH | 2.8 | 5.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H... |
| v3.0 | n/a | ||||
| v2.0 | n/a | ||||
66.10%
Current Score
0.00%
98%ile
Percentile Rank
0.00%
Loading chart...
Loading chart...
Improper Control of Generation of Code ('Code Injection') CWE-94
Description:The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Vulnerability Name:Microsoft SharePoint Code Injection Vulnerability
Added to CISA Catalog:22 Jul 2025, 00:00
Action Due:23 Jul 2025, 00:00
Known Ransomware: Ransomware
Required Action:Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
No dark web activity detected for this vulnerability.
metasploit
Windows
exploitVerifiedAuthors: Viettel Cyber Security, sfewer-r7
Published: 08 Jul 2025, 00:00
Updated: 06 Aug 2025, 15:33
This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe
deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft
SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704,
and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path.
As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders),
we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.
CVE-2025-49704CVE-2025-49706CVE-2025-53770CVE-2025-53771blog.viettelcybersecurity.com/sharepoint-toolshell/blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/securelist.com/toolshell-explained/zerodayinitiative.com/advisories/ZDI-25-580/zerodayinitiative.com/advisories/ZDI-25-581/msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
Affected Configurations (CPE)
microsoft sharepoint_serverVulnerable
Version: 2016
cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
microsoft sharepoint_serverVulnerable
Version: 2019
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
| URL | Tags | Source |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704 | vendor advisory | secure@microsoft.com |
| https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ | vendor advisory | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |