Advisory 2025-1473 - Microsoft SharePoint (On-premises): Multiple Vulnerabilities

Operating System

• Sonstiges
• Windows

Software

• Microsoft SharePoint Subscription Edition < KB5002768
• Microsoft SharePoint Server 2016
• Microsoft SharePoint Server 2016 < KB5002744 Build 16.0.5508.1000
• Microsoft SharePoint Server 2019 < KB5002741 Build 16.0.10417.20027
• Microsoft SharePoint Server 2019 < KB5002754

Attack

A remote anonymous or authenticated attacker can exploit multiple vulnerabilities in Microsoft SharePoint Server 2019, Microsoft SharePoint Subscription Edition and Microsoft SharePoint Server 2016 in order to execute arbitrary code and to perform spoofing attacks.

Description

Microsoft SharePoint is a browser-based collaboration and document management platform. It can be used to host web sites that access shared workspaces and documents, as well as specialized applications like wikis and blogs from a browser. Microsoft SharePoint is a browser-based collaboration and document management platform. It can be used to host web sites that access shared workspaces and documents, as well as specialized applications like wikis and blogs from a browser.

A vulnerability exists that only affects local Microsoft SharePoint deployments: SharePoint Server 2019, 2016, and Subscription Edition. The vulnerability escalated from a problem initially classified as a spoofing vulnerability (CVE-2025-49706) into a more critical security flaw. The cause is the insecure deserialization of untrusted data, allowing attackers to inject a backdoor. This backdoor can then be used to read the ASP.NET MachineKeys. This enables manipulation and falsification of __VIEWSTATE payloads with a valid signature. As a result, a remote, unauthenticated attacker can execute arbitrary code in the context of the SharePoint server and potentially gain persistent access to the system.

There is a vulnerability in Microsoft SharePoint Server 2016 and Microsoft SharePoint Server 2019. The flaw arises from the improper limitation of a pathname to a restricted directory, which allows for a path traversal issue. A remote authenticated attacker can exploit this vulnerability to perform spoofing attacks. Successful exploitation requires a user interaction.

Recommendation

Microsoft provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

There is currently no update or patch available to fix this vulnerability.
https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

Information

Microsoft Update Guide CVE-2025-53770 dated 2025-07-20
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

Microsoft Customer guidance for SharePoint vulnerability CVE-2025-53770 dated 2025-07-20
https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

Canadian Centre for Cyber Security - Alert AL25-009 dated 2025-07-20
https://cyber.gc.ca/en/alerts-advisories/al25-009-vulnerability-impacting-microsoft-sharepoint-server-cve-2025-53770

Microsoft Update Guide CVE-2025-53771 dated 2025-07-20
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771