Sitecore XP Report.ashx Deserialization

aka SC2021-003-499266

Product: Sitecore Sitecore Experience Platform (XP)
CVE: CVE-2021-42237
Disclosed: 2021-11-08
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 7.5 Initial Release - 7.5 Update 2, 8.0 Initial Release - 8.2 Update 7
Fixed: Hotfix / remove Report.ashx (9.0+ not affected)

Summary

A forgotten reporting handler in older Sitecore XP releases deserialized XML request bodies with NetDataContractSerializer. Unauthenticated POSTs to Report.ashx yield code execution on the IIS server.

Root cause

/sitecore/shell/ClientBin/Reporting/Report.ashx calls ReportDataSerializer.DeserializeQuery on the request stream, which uses NetDataContractSerializer for <parameter> values. That serializer honours z:Type attributes, so a .NET gadget chain (e.g. via SortedSet / ObjectDataProvider) executes commands.

Impact

Unauthenticated RCE on legacy Sitecore 7.5 - 8.2 sites.

Public PoC

POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1
Host: sitecore.local
Content-Type: text/xml

<?xml version="1.0" ?>
<a>
  <query></query>
  <source>foo</source>
  <parameters>
    <parameter name="">
      <ArrayOfstring z:Id="1" z:Type="System.Collections.Generic.SortedSet`1[[System.String, mscorlib, ...]]" ...>
        <!-- NetDataContractSerializer gadget chain (ysoserial.net) -->
      </ArrayOfstring>
    </parameter>
  </parameters>
</a>

Source: Assetnote (Searchlight Cyber) research

Detection

Look for POSTs to /sitecore/shell/ClientBin/Reporting/Report.ashx. nuclei template CVE-2021-42237.

Mitigation

Delete Report.ashx from /sitecore/shell/ClientBin/Reporting/ or apply Sitecore's hotfix; upgrade to a supported version.