Saint ToolShell, Who Took SharePoint's Keys

Patron of on-premises SharePoint servers, deserialization forms, and administrators called back in on weekends.

Life

In July 2025 Dinh Ho Anh Khoa and other researchers made known ToolShell (CVE-2025-53770), a chain against on-premises SharePoint Server. Without authentication it reached code execution, and worse still it let attackers steal the server's cryptographic keys, which allowed forging valid requests and keeping access even after the patch. Hundreds of organisations were compromised before everyone updated; CISA listed it among exploited vulnerabilities.

Prayer

O Saint ToolShell, who steals the house keys and then reforges them at will, teach our servers to rotate their secrets after every wound. Amen.

How to celebrate

Celebrated by applying the SharePoint patches, rotating the ASP.NET keys and carefully looking for signs of guests already passed through.

Who steals the keys comes back even after the new lock.