Sitecore 8.x – Deserialization Remote Code Execution
# Exploit Title: Sitecore v 8.x Deserialization RCE # Date: Reported to vendor October 2018, fix released April 2019. # Exploit Author: Jarad Kopf # Vendor Homepage: https://www.sitecore.com/ # Software Link: Sitecore downloads: https://dev.sitecore.net/Downloads.aspx # Version: Sitecore 8.0 Revision 150802 # Tested on: Windows # CVE : CVE-2019-11080 Exploit: Authentication is needed for this exploit. An attacker needs to login to Sitecore 8.0 revision 150802's Admin section. When choosing to Serializeusers or domains in the admin UI, calls to /sitecore/shell/~/xaml/Sitecore.Shell.Applications.Dialogs.Progress.aspx will include a CSRFTOKEN parameter. By replacing this parameter with a URL-encoded, base64-encoded crafted payload from ysoserial.net, an RCE is successful. |