SharePoint Header Spoofing

A header spoofing vulnerability in Microsoft SharePoint that allows unauthenticated access to administrative endpoints. When combined with CVE-2025-53770 (ToolShell RCE), it creates a complete unauthenticated remote code execution chain.

## Vulnerability Overview
SharePoint Server trusts certain HTTP headers for internal service-to-service authentication. An external attacker can forge these headers to impersonate an authenticated internal service, bypassing all authentication checks and gaining access to administrative API endpoints.

## Technical Details
- **Type:** Authentication Bypass via Header Spoofing (CWE-290)
- **Root Cause:** SharePoint's authentication middleware checks for the presence of specific internal headers (X-SharePoint-AppToken, X-RequestDigest) and trusts requests containing these headers as originating from trusted internal services. No validation of the header values or source IP is performed.
- **Chain with CVE-2025-53770:** The header spoofing provides unauthenticated access to the deserialization endpoint, enabling the ToolShell RCE.

## Impact
- Complete authentication bypass
- Access to administrative endpoints without credentials
- When chained with ToolShell: full unauthenticated RCE