CVE-2019-9875

published 2019-05-31

CVE-2019-9875: Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a…

Priority P1 83 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

KEV ITW

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
sitecore	cms	<= 9.1	—

Detection & IOCs extracted from sources · hover to see the quote

other __CSRFTOKEN↗

• → Monitor HTTP POST requests containing the __CSRFTOKEN parameter for serialized .NET object payloads (e.g., binary/base64-encoded data inconsistent with a normal CSRF token value), targeting Sitecore CMS/XP endpoints. ↗
• → Focus detection on the Sitecore.Security.AntiCSRF module processing path, as deserialization of untrusted data occurs within this module. ↗
• → Exploitation requires an authenticated session; correlate suspicious __CSRFTOKEN POST activity with valid authenticated Sitecore sessions to prioritize alerts. ↗

• · Vulnerability affects Sitecore CMS and Experience Platform (XP) through version 9.1; confirm scope of affected versions before applying detections. ↗
• · Vendor mitigation guidance is available; refer to Sitecore KB0038556 for patch/configuration details before relying solely on detection. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vulncheck 8.8 HIGH

cisa 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502