RCE vulnerability found in Sitecore enterprise CMS software

guest · Nov 3, 2021

RCE vulnerability found in Sitecore enterprise CMS software
Vendor update is available now
November 3, 2021
https://portswigger.net/daily-swig/rce-vulnerability-found-in-sitecore-enterprise-cms-software

A remote code execution vulnerability has been found in enterprise CMS product Sitecore XP that could leave all unpatched instances open to abuse.

Sitecore is an enterprise content management system (CMS), which according to researchers from Assetnote has an estimated 4,500 customers, including Fortune 500 companies.
Click to expand...

The researchers found that the software was vulnerable to a pre-authentication RCE attack due to insecure deserialization in the Report.ashx file.
They discovered the vulnerability while probing Sitecore’s attack surface during a client engagement.

A blog post published yesterday (November 2) includes full technical details.
Click to expand...

The vulnerability is pending a CVE number but is being tracked by the vendor as SC2021-003-499266.
Sitecore has advised users to upgrade to version 9.0.0 or higher which protects against the vulnerability.

The Daily Swig has reached out to Assetnote for more information and will update this article accordingly.
Click to expand...

Sitecore Experience Platform Pre-Auth RCE

This blog post demonstrates a pre-authentication RCE against Sitecore XP.
The apps that we have been auditing are complex, however the vulnerabilities are quite simple. With a concerted effort in taking apart these enterprise apps, we are able to discover critical vulnerabilities, after understanding the attack surface.

We believe that this is because of how difficult it can be to obtain copies of enterprise software, but also because it is rare for attackers to perform in-depth source code analysis where sources and sinks are mapped out for large and complex enterprise applications.
Click to expand...

guest · Nov 8, 2021

Sitecore XP RCE flaw patched last month now actively exploited
November 8, 2021
https://www.bleepingcomputer.com/ne...aw-patched-last-month-now-actively-exploited/

The Australian Cyber Security Center (ACSC) is alerting web admins of the active exploitation of CVE-2021-42237, a remote code execution flaw in the Sitecore Experience Platform (Sitecore XP).

Sitecore XP is an enterprise-level content management system with data analytics (CMS) used by well-known companies, including American Express, IKEA, Carnival Cruise Lines, L'Oréal, and Volvo.
Click to expand...

On October 13th, Sitecore disclosed and released a patch for a pre-authentication remote code execution vulnerability tracked as CVE-2021-42237 affecting the Sitecore Experience Platform.

Last week, cybersecurity firm Assetnote published a technical write-up on vulnerability allowing hackers to use the details to create exploits and actively exploit vulnerable websites.

"There is active exploitation of a vulnerability occurring in certain versions of Sitecore Experience Platform systems. Affected Australian organisation should apply the available security update," warned the ACSC in a new advisory released Friday.
The vulnerability does not require authentication, and it allows any remote attacker to exploit a vulnerable server and gain complete control over it.
Click to expand...

Log in or Sign up

RCE vulnerability found in Sitecore enterprise CMS software

guest Guest

guest Guest

Log in or Sign up

RCE vulnerability found in Sitecore enterprise CMS software

guest Guest

guest Guest

Useful Searches