Microsoft SharePoint Server远程代码执行漏洞(CVE-2025-53770)

详细信息

漏洞类型

通用型漏洞

漏洞描述

Microsoft SharePoint Server Subscription Edition、Microsoft SharePoint Server 2019、Microsoft SharePoint Enterprise Server 2016中不受信任数据的反序列化允许未经授权的攻击者通过网络执行代码。利用此漏洞的攻击者不仅会注入任意代码，还会滥用SharePoint反序列化不受信任对象的方式，使其甚至在身份验证之前就能执行命令。一旦进入系统，他们就可以使用窃取的机器密钥伪造受信任的有效载荷，从而实现持久化或横向移动，并经常与合法的SharePoint活动混杂在一起。此漏洞是CVE-2025-49706的变种。

修复建议

请应用KB5002768、KB5002754修复程序，参考链接： https://www.microsoft.com/en-us/download/details.aspx?id=108285 https://www.microsoft.com/en-us/download/details.aspx?id=108286 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

缓解措施

在SharePoint中配置AMSI集成，并在所有SharePoint服务器上部署Defender AV。如果无法启用AMSI，建议在官方缓解措施可用之前，断开互联网上面向公众的受影响产品的服务。

参考链接

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

  CVE · vendor-advisory

• https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/

  NVD · Press/Media Coverage

• https://github.com/kaizensecurity/CVE-2025-53770

  NVD · Exploit

• https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/

  NVD · Press/Media Coverage

• https://news.ycombinator.com/item?id=44629710

  NVD · Issue Tracking

• https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

  NVD · Vendor Advisory · Mitigation

• https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/

  NVD · Press/Media Coverage · Exploit

• https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770

  NVD · Mailing List · Third Party Advisory · US Government Resource

• https://x.com/Shadowserver/status/1946900837306868163

  NVD · Third Party Advisory

• https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally

  NVD · Press/Media Coverage

• https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw

  NVD · Press/Media Coverage

• https://research.eye.security/sharepoint-under-siege/

  NVD · Exploit · Third Party Advisory · Mitigation

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770

  NVD · US Government Resource