{"id":8970,"date":"2025-07-25T12:57:08","date_gmt":"2025-07-25T12:57:08","guid":{"rendered":"http:\/\/localhost\/?p=8970"},"modified":"2025-07-25T12:57:08","modified_gmt":"2025-07-25T12:57:08","slug":"toolshell-remote-code-execution-in-microsoft-sharepoint-cve-2025-53770","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=8970","title":{"rendered":"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)"},"content":{"rendered":"<h2>Security Update News<\/h2>\n<h3>Update Information<\/h3>\n<table style=\"width:100%; border-collapse: collapse; margin-bottom: 20px;\">\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Title<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Update ID<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">WALLARMLAB:404FAFD231E5C37C2580D301BEEEFE3B<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Type<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">wallarmlab<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Published<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">2025-07-25T14:17:00<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Last Updated<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">2025-07-25T14:17:00<\/td>\n<\/tr>\n<\/table>\n<h3>Security Impact<\/h3>\n<table style=\"width:100%; border-collapse: collapse; margin-bottom: 20px;\">\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">CVSS Score<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">9.8<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Severity<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd; color: #cc0000; font-weight: bold;\">CRITICAL<\/td>\n<\/tr>\n<\/table>\n<h3>Affected CVEs<\/h3>\n<div style=\" padding: 15px; border: 1px solid #ddd; margin-bottom: 20px;\">\n<ul style=\"margin: 0; padding-left: 20px;\">\n<li>CVE-2025-49704<\/li>\n<li>CVE-2025-49706<\/li>\n<li>CVE-2025-53770<\/li>\n<\/ul>\n<\/div>\n<h3>Update Details<\/h3>\n<div style=\"; padding: 15px; border-left: 4px solid #4CAF50; margin-bottom: 20px;\">\nOn July 19, 2025, a critical remote code execution (RCE) vulnerability (CVE-2025-53770, also referred to as ToolShell) was publicly disclosed, impacting on-premises Microsoft SharePoint Server installations. This vulnerability allows unauthenticated attackers to execute arbitrary code remotely by leveraging insecure deserialization techniques. Given the platform\u2019s widespread use and exposure to the internet, the potential for compromise is substantial and growing, especially with confirmed active exploitation in the wild.<\/p>\n<p>## **Vulnerability Overview**<\/p>\n<p>CVE-2025-53770 targets Microsoft SharePoint via a flaw in **ViewState deserialization** , specifically triggered at the endpoint:<\/p>\n<p>`\/_layouts\/15\/ToolPane.aspx`<\/p>\n<p>By abusing the **Referer header** (pointing to `\/_layouts\/SignOut.aspx`) and uploading a crafted .aspx file (e.g., spinstall0.aspx), attackers can bypass authentication and execute remote payloads. Once executed, these payloads can extract **ASP.NET machine keys** (`ValidationKey` and `DecryptionKey`) from the server, enabling the creation of malicious `ViewState` data that the server will accept as legitimate.<\/p>\n<p>This vulnerability falls under \u201cOWASP A08:2021 \u2013 Software and Data Integrity Failures,\u201d specifically due to its insecure deserialization. The attack chain may also involve two auxiliary vulnerabilities: CVE-2025-49706 and CVE-2025-49704, which exacerbate the impact.<\/p>\n<p>CVE-2025-53770 is classified as a critical pre-authentication remote code execution vulnerability, with an estimated CVSS score of 9.8, reflecting its ease of exploitation, lack of required privileges, and severe potential impact.<\/p>\n<p>## **Exploitation in the Wild**<\/p>\n<p>### **Exploit Mechanics**<\/p>\n<p>The root cause lies in **insecure deserialization** via ViewState, specifically the injection of a malicious control such as:<\/p>\n<p>`<Scorecard:ExcelDataSet CompressedDataTable=\"...\" \/>`<\/p>\n<p>This payload, when deserialized by SharePoint, leads to arbitrary code execution if the attacker already possesses machine keys. Below is a truncated exploit example via curl:<\/p>\n<p>`curl -sk -X POST &#8216;https:\/\/victim.com\/_layouts\/15\/ToolPane.aspx?DisplayMode=Edit&#038;a=\/ToolPane.aspx&#8217; -H &#8216;Referer: \/_layouts\/SignOut.aspx&#8217; -H &#8216;Content-Type: application\/x-www-form-urlencoded&#8217; &#8211;data-urlencode &#8216;MSOTlPn_Uri=https:\/\/malicious.com&#8217; &#8211;data-urlencode &#8216;MSOTlPn_DWP=<Scorecard:ExcelDataSet CompressedDataTable=\"...\" \/>&#8216; `<\/p>\n<p>## **Wallarm Response and Observed Exploitation**<\/p>\n<p>Wallarm deployed detection rules shortly after disclosure to identify and block exploitation attempts of CVE-2025-53770. Within hours, Wallarm customers were protected. The rules detect crafted ViewState payloads and abnormal access to the vulnerable endpoint.<\/p>\n<p>![A screenshot from the Wallarm interface showing a detected attack.](https:\/\/i0.wp.com\/lab.wallarm.com\/wp-content\/uploads\/2025\/07\/first-image.png?resize=770%2C321&#038;ssl=1)<\/p>\n<p>Wallarm detected immediate spikes in exploit attempts following the public disclosure:<\/p>\n<p>![A line graph showing the increase in attacks detected by Wallarm starting July 20 and peaking on July 22](https:\/\/i0.wp.com\/lab.wallarm.com\/wp-content\/uploads\/2025\/07\/second-image.png?resize=770%2C473&#038;ssl=1)<\/p>\n<p>These figures show rapid adoption of the exploit code by threat actors. Public repositories on GitHub have already published working proof-of-concept payloads, lowering the bar for exploitation even further.<\/p>\n<p>## Mitigation <\/p>\n<p>Wallarm recommends clients:<\/p>\n<p>  * Patch affected SharePoint servers immediately<br \/>  * Rotate ASP.NET cryptographic keys<br \/>  * Inspect systems for indicators of compromise<br \/>  * Isolate public-facing SharePoint instances if unpatched<\/p>\n<p>This layered defense ensures both proactive mitigation and forensic readiness.<\/p>\n<p>## **Conclusion**<\/p>\n<p>CVE-2025-53770 is an example of the critical risks posed by pre-authentication RCE vulnerabilities in widely exposed platforms like Microsoft SharePoint. While patching and key rotation are essential, they alone are not sufficient to defend against rapidly evolving threats.<\/p>\n<p>A Web Application and API Protection (WAAP) solution is vital to a multilayered security strategy, providing virtual patching, real-time threat detection, and attack surface protection, especially during the high-risk period between disclosure and remediation. Wallarm\u2019s rapid response to this vulnerability illustrates how WAAP can effectively close the gap, blocking exploit attempts before they impact critical systems.<\/p>\n<p>### **Risk Summary**<\/p>\n<p>  * Pre-auth RCE with high reliability<br \/>  * Targets a widely-used enterprise collaboration platform<br \/>  * Potential for data theft, lateral movement, and persistence<\/p>\n<p>### **Public Exposure: Shodan Insights**<\/p>\n<p>As of publication, **Shodan search results** show **16,405 internet-facing SharePoint instances** , many of which are likely vulnerable. This highlights the scale of exposure and the urgency of remediating public deployments.<\/p>\n<p>![A screenshot from Shodan showing the number of detected instances of Sharepoint.](https:\/\/i0.wp.com\/lab.wallarm.com\/wp-content\/uploads\/2025\/07\/third-image.png?resize=487%2C768&#038;ssl=1)<\/p>\n<p>## **References**<\/p>\n<p>  * NVD NIST: CVE-2025-53770<br \/>  * Vendor Advisory: Microsoft Guidance <br \/>  * https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-53770<br \/>  * Security Research: GitHub Exploit Repository<br \/>  * Exploit Payload: Example Payload<\/p>\n<p>The post ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) appeared first on Wallarm.\n<\/p><\/div>\n<p><a href=\"https:\/\/lab.wallarm.com\/toolshell-remote-code-execution-in-microsoft-sharepoint-cve-2025-53770\/\" target=\"_blank\" style=\"display: inline-block; color: white; padding: 10px 20px; text-decoration: none; border-radius: 4px;\">View Advisory Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security Update News Update Information Title ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) Update ID WALLARMLAB:404FAFD231E5C37C2580D301BEEEFE3B Type wallarmlab Published 2025-07-25T14:17:00 Last Updated 2025-07-25T14:17:00 Security&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[9,6,8,35,12,13,7,11,5,105],"class_list":["post-8970","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability","tag-wallarmlab"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=8970\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Security Update News Update Information Title ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) Update ID WALLARMLAB:404FAFD231E5C37C2580D301BEEEFE3B Type wallarmlab Published 2025-07-25T14:17:00 Last Updated 2025-07-25T14:17:00 Security...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=8970\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-25T12:57:08+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8970#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8970\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)\",\"datePublished\":\"2025-07-25T12:57:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8970\"},\"wordCount\":748,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CRITICAL\",\"CVE\",\"CVSS\",\"CVSS-9.8\",\"exploit\",\"news\",\"Security\",\"tapic\",\"Vulnerability\",\"wallarmlab\"],\"articleSection\":[\"category_news\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=8970#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8970\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8970\",\"name\":\"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-07-25T12:57:08+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8970#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=8970\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8970#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=8970","og_locale":"en_US","og_type":"article","og_title":"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) - zero redgem","og_description":"Security Update News Update Information Title ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) Update ID WALLARMLAB:404FAFD231E5C37C2580D301BEEEFE3B Type wallarmlab Published 2025-07-25T14:17:00 Last Updated 2025-07-25T14:17:00 Security...","og_url":"https:\/\/zero.redgem.net\/?p=8970","og_site_name":"zero redgem","article_published_time":"2025-07-25T12:57:08+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=8970#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=8970"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)","datePublished":"2025-07-25T12:57:08+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=8970"},"wordCount":748,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CRITICAL","CVE","CVSS","CVSS-9.8","exploit","news","Security","tapic","Vulnerability","wallarmlab"],"articleSection":["category_news"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=8970#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=8970","url":"https:\/\/zero.redgem.net\/?p=8970","name":"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770) - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-07-25T12:57:08+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=8970#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=8970"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=8970#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/8970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8970"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/8970\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}