Attack Chain

1. Initial Access: The attacker gains initial access to the SharePoint server, exploiting CVE-2025-53770 via a specially crafted request to the ToolPane.aspx endpoint.
2. Webshell Deployment: Successful exploitation leads to the deployment of the "spinstall0.aspx" webshell in the SharePoint layouts directory, typically located at /_layouts/15/.
3. Backdoor Establishment: The webshell acts as a persistent backdoor, allowing the attacker to execute arbitrary commands on the SharePoint server.
4. Reconnaissance: The attacker uses the webshell to perform reconnaissance activities, gathering information about the system, network, and user accounts.
5. Credential Access: The attacker attempts to extract sensitive information, such as encryption keys, authentication tokens, and stored credentials, from the compromised SharePoint server.
6. Data Exfiltration: The attacker uses the webshell to exfiltrate sensitive data from the SharePoint server to an external location.
7. Lateral Movement: The attacker leverages the compromised SharePoint server as a pivot point to move laterally within the network, targeting other systems and resources.

Impact

Successful exploitation of CVE-2025-53770 and deployment of the spinstall0.aspx webshell can lead to complete compromise of the SharePoint server and potentially the entire network. Attackers can steal sensitive data, including confidential documents, employee credentials, and customer information. This can result in significant financial losses, reputational damage, and legal liabilities. The number of victims and the extent of the damage depend on the attacker's objectives and the security measures in place.

Recommendation

• Deploy the Sigma rule SharePoint spinstall0.aspx Webshell GET Request to detect GET requests to the spinstall0.aspx webshell.
• Monitor web server logs for requests to URLs matching the pattern */_layouts/15/spinstall0.aspx*, as indicated in the IOCs, to identify potential webshell activity.
• Investigate any alerts generated by the Sigma rule or manual analysis of web server logs to determine the source and scope of the attack.
• Patch CVE-2025-53770 on all SharePoint servers immediately to prevent initial exploitation.
• Enable comprehensive logging for SharePoint web servers and ensure that all HTTP requests are being captured and forwarded to your SIEM, as described in the "How to Implement" section of the original source.