id: CVE-2025-53770-insikt

info:
  name: CVE-2025-53770 Microsoft SharePoint Server Deserialization Vulnerability (ToolShell)
  author: ACHA, Insikt Group, Recorded Future
  severity: critical
  description: |
    Detects SharePoint Server versions that are vulnerable to a deserialization of untrusted data flaw. This template sends a GET request to the "/_vti_pvt/service.cnf" endpoint, extracts the "vti_extenderversion" build number, and checks if it is within the documented vulnerable ranges.
  impact: |
    Remote, unauthenticated attackers can achieve remote code execution (RCE).
  remediation: |
    Apply Microsoft's security update (see reference below) to patch SharePoint Server Subscription Edition and SharePoint Server 2019. A patch is currently unavailable for SharePoint Server 2016.
  reference:
    - https://research.eye.security/sharepoint-under-siege
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53770
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
    - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770 # Patch
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-53770
    cwe-id: CWE-502 # Deserialization of Untrusted Data
  metadata:
    verified: true
    max-request: 1
    date: 2025-07-22
    last-updated: 2025-07-22
    unique-rule-id: 67a542d9-a1b3-48f5-b725-589464ebfa4f
    mitre-att&ck:
      - attack.t1595.002 # Active Scanning: Vulnerability Scanning
    shodan-query: "MicrosoftSharePointTeamServices"
    vendor: Microsoft
    product: SharePoint Server
  tags: cve,cve2025,kev,rce

requests:
  - method: GET
    path:
      - "{{BaseURL}}/_vti_pvt/service.cnf"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - |
            contains(to_lower(body), "vti_extenderversion:sr|16.0.0.") &&
            (
              (to_number(build_number) >= 4351 && to_number(build_number) < 5508) ||
              (to_number(build_number) >= 10331 && to_number(build_number) < 10417) ||
              (to_number(build_number) >= 14326 && to_number(build_number) < 18526)
            )
        condition: or

    extractors:
      - type: regex
        name: build_number
        part: body
        group: 1
        regex:
          - "vti_extenderversion:SR\\|16\\.0\\.0\\.(\\d+)"
        internal: true
