Analyzing Sharepoint Exploits (CVE-2025-53770, CVE-2025-53771), (Wed, Jul 23rd)

This SANS write-up analyzes active exploit attempts targeting SharePoint (CVE-2025-53771) which use ToolPane.aspx to deliver a .NET deserialization payload that ultimately creates spinstall0.aspx; that page reveals the system MachineKey, allowing attackers to sign forged ViewState data and gain unauthorized access — the report includes decoded payloads, exploitation indicators, and remediation advice (rotate MachineKeys).