# Bypass IIS Authorisation with this One Weird Trick - Three RCEs and Two Auth Bypasses in Sitecore 9.3

Sitecore 9.3 Server.Execute in SimulatorController Preview bypasses IIS auth, leaking Web.config to unlock Telerik deserialization RCE, plus Invoke.aspx reflection RCE.

- Payout: Research
- Severity: critical
- Program: Sitecore
- Credited: Assetnote
- Disclosed: 2025-02-12
- Write-up quality: 9/10
- Original: https://www.assetnote.io/resources/research/bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-sitecore-9-3
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s
- Tags: domain:web impact:data-leak impact:rce kind:research platform:research sev:critical tech:dotnet technique:chained technique:source-review vuln:auth-bypass vuln:deserialization vuln:info-disclosure vuln:rce

**Target:** Sitecore 9.3 CMS (.NET/IIS) web handlers, MVC controllers, Invoke.aspx, Telerik UI
**Root cause:** SimulatorController.Preview passes user-controlled previewPath to Server.Execute, which re-executes files without rerunning the IIS auth pipeline; separately Invoke.aspx reflects arbitrary type/method calls and ConvertWebControls feeds HTML attributes into BinaryFormatter.Deserialize.
**Steps:**
1. Enumerate handlers from Web.config and App_Config/Sitecore.config customHandlers mappings
2. Decompile DLLs with dnSpy; find Sitecore.Mvc.DeviceSimulator.Controllers.SimulatorController.Preview calling ExecuteHandlerAction -> Server.Execute(previewPath)
3. Request `GET /api/sitecore/Sitecore.Mvc.DeviceSimulator.Controllers.SimulatorController,Sitecore.Mvc.DeviceSimulator.dll/Preview?previewPath=/App_Data/license.xml` to confirm file read
4. Brute-force `/App_Data/diagnostics/configuration_history/<timestamp>.zip` (86400/sec-resolution combos per day) to leak Web.config
5. Extract Telerik encryption keys; run CVE-2019-18935 RAU_crypto against `/Telerik.Web.UI.WebResource.axd?type=rau` to upload mixed-mode DLL and deserialize for RCE
6. For unauth chain: obtain ec_message_id/ec_id from a mailing list email so LoadEmailRenderSessionUser sets HttpContext.User, then POST to Preview with previewPath=/sitecore/shell/Invoke.aspx and __OBJECT=Telerik.Web.UI.RadPivotGrid.set_FiltersPersistence("PivotGridReportFilter;x;<ysoserial base64>")
7. Authenticated RCE: POST html with `<div class="scInlineControl" id="X"><div id="X_inner" value="<base64>">` to `/sitecore/shell/Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML`
**How found:** Enumerated .aspx/.ashx/.asmx and Web.config handler mappings, decompiled DLLs with dnSpy, set breakpoints on SitecoreControllerFactory.CreateController to confirm the api/sitecore route, then audited IController implementations and BinaryFormatter sinks working backwards from code-execution primitives.
**Exploitation:** Server.Execute bypasses IIS authorization to read arbitrary webroot files; leaked Web.config yields Telerik keys enabling CVE-2019-18935 deserialization RCE. Combined with EXM renderer-user session, Invoke.aspx reflection into RadPivotGrid.set_FiltersPersistence reaches BinaryFormatter.Deserialize unauthenticated.
**Escalation:** File-read auth bypass chained to config leak, then to Telerik deserialization RCE; separate reflection sink chained with EXM user-context injection for unauthenticated RCE.
**Insight:** In .NET/IIS apps, grep decompiled code for Server.Execute/Server.Transfer with user-controlled paths: they re-execute files inside the request without rerunning the IIS authorization module, so any handler reachable pre-auth becomes a file-read primitive over the webroot (e.g. config backups under App_Data).