The Cloudflare Blog: Cloudflare protects against critical SharePoint vulnerability, CVE-2025-53770

Jul 22, 2025

—

Source URL: https://blog.cloudflare.com/cloudflare-protects-against-critical-sharepoint-vulnerability-cve-2025-53770/
Source: The Cloudflare Blog
Title: Cloudflare protects against critical SharePoint vulnerability, CVE-2025-53770

Feedly Summary: Microsoft disclosed two critical vulnerabilities, CVE-2025-53771 and CVE-2025-53770, that are exploited to attack SharePoint servers.

AI Summary and Description: Yes

**Summary:** The text discusses the critical CVE-2025-53770 vulnerability in Microsoft SharePoint that allows remote code execution and highlights its sophisticated exploit chain, ToolShell. It emphasizes the importance of immediate remediation, particularly through Cloudflare’s Web Application Firewall (WAF) Managed Rules to mitigate the threat posed by this vulnerability.

**Detailed Description:**
The text provides in-depth information about CVE-2025-53770, a critical vulnerability affecting multiple versions of Microsoft SharePoint that allows remote code execution due to improper deserialization of untrusted data. Key aspects of the text include:

– **Vulnerability Overview:**
– CVE-2025-53770 has a CVSS base score of 9.8, marking it as critical.
– It affects SharePoint Server versions 2016, 2019, and the Subscription Edition, as well as older unsupported versions.
– An emergency response was initiated by CISA, adding this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline.

– **Exploit Methodology (ToolShell):**
– ToolShell combines initial exploitation through an authentication bypass (CVE-2025-53771) with a mechanism for long-term access.
– Attackers can steal cryptographic machine keys (ValidationKey and DecryptionKey), allowing for persistent access and manipulation of tokens.

– **Exploit Chain Phases:**
– **Stage 1 – Authentication Bypass:** Attackers trick SharePoint into trusting them by manipulating HTTP headers.
– **Stage 2 – Remote Code Execution:** By sending malicious payloads to the ToolPane.aspx endpoint, attackers exploit the deserialization flaw to execute arbitrary commands.
– **Stage 3 – Key Theft:** Attackers capture machine keys to establish long-term access, enabling new payload executions even after initial defenses are placed.

– **Mitigation Strategies:**
– Cloudflare has developed and released emergency WAF Managed Rules to provide immediate protections against these vulnerabilities.
– Continuous monitoring of HTTP requests for this vulnerability is crucial for identifying potential exploitation attempts.

This detailed analysis underscores the ongoing challenges in cybersecurity, highlighting how attackers evolve their strategies while reinforcing the necessity for proactive and adaptive security measures in both corporate networks and cloud environments. The urgent remediation directives and the capabilities of tools like Cloudflare’s WAF illustrate the collaborative effort needed among security professionals to combat these sophisticated threats.

01 1 2 2025 3 5 53 7 a access Act adaptive adaptive security ads after AI analysis and app Application art as at ated attack attackers authentication Authentication Bypass Bi by bypass C capabilities catalog chain challenge challenges CI CIA CISA closed Cloud cloud environment cloud environments Cloudflare co code code execution Col collaborative collaborative effort command continuous continuous monitoring core critical critical vulnerability Crypto cryptographic CVE CVSS cyber cybersecurit Cybersecurity D data de decryption defense defenses depth deserialization deserialization flaw directive e E 3 emergency response end endpoint environment execution exp exploit exploit chain Exploitation exploited vulnerabilities firewall for g Gen Go graph H headers high Highlight HR http HTTPS in information io Iron ite k Key keys Known Exploited Vulnerabilities Known Exploited Vulnerabilities Catalog l Labor law led Li long low M mac machine machine keys malicious payload man Managed Rules manipulation measures media Micro Microsoft Microsoft SharePoint mitigation mitigation strategies Monitor monitoring multi N network networks new NGO no o of on oS out over pay per phi point potential pro proactive professionals protection ps Q R rate RCE release remediation remote Remote Code Execution response Ro RoT Rust s sec security security measure security measures security professionals serialization server servers SHA SharePoint SharePoint Server SharePoint servers size source SSE strategies subscription support T ted text the theft threat threats to token tokens tool tools Tor TP trust two under up US uth V val Valid Validation version vulnerabilities vulnerabilities catalog vulnerability web web application web application firewall Well Wi x z