CVE-2019-10068
Kentico Xperience Deserialization of Untrusted Data Vulnerability
Description
CVE-2019-10068 is an insecure deserialization vulnerability in Kentico Xperience (formerly Kentico CMS) that allows an unauthenticated attacker to achieve remote code execution. The flaw exists in the way Kentico processes serialized .NET objects, enabling an attacker to craft malicious payloads that execute arbitrary code when deserialized by the server. Kentico is a widely used enterprise content management and digital experience platform. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, and with an EPSS score of 97.3% (99.9th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| kentico | xperience | >= 9.0.0, <= 9.0.51; >= 10.0.0, < 10.0.52; >= 11.0.0, < 11.0.48; >= 12.0.0, < 12.0.15 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157588/Kentico-CMS-12.0.14-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://devnet.kentico.com/download/hotfixes#securityBugs-v12(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10068(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2019-10068 is classified under CWE-502, which describes vulnerabilities where an application deserializes data from untrusted sources without adequate validation. Kentico Xperience processes serialized .NET objects from user-controlled input without verifying the object types or contents, allowing attackers to inject malicious objects that execute arbitrary code during the deserialization process.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2019-10068 enables unauthenticated remote attackers to execute arbitrary code on servers running Kentico Xperience. The web application typically runs with elevated privileges, and successful exploitation grants the attacker the ability to access and exfiltrate all content and user data managed by Kentico, execute operating system commands on the underlying server, modify website content to serve malware or phishing pages, access backend databases containing customer and business data, and establish persistent backdoor access. The unauthenticated attack vector and the enterprise nature of typical Kentico deployments make this vulnerability particularly dangerous. The EPSS score of 97.3% confirms near-certain exploitation.
Exploit Maturity
CVE-2019-10068 has been confirmed as actively exploited in the wild by CISA. Public exploit code and detailed technical write-ups are available, and .NET deserialization attack tools such as ysoserial.net can be used to generate exploitation payloads. With an EPSS score of 97.3% (99.9th percentile), exploitation is near-certain for any exposed Kentico instance running a vulnerable version.
Remediation
- Upgrade Kentico Xperience: Update to Kentico Xperience version 12.0.15 or later, which contains patches for CVE-2019-10068.
- Apply hotfix if immediate upgrade is not possible: Kentico has released hotfixes for older versions — apply the appropriate hotfix following the vendor's security advisory.
- Restrict application access: Limit network access to the Kentico instance, particularly the administrative endpoints, to trusted networks only.
- Implement Web Application Firewall rules: Deploy WAF rules to detect and block .NET deserialization attack patterns in incoming HTTP requests.
- Conduct a security assessment: If the Kentico instance was exposed prior to patching, perform a thorough investigation for signs of compromise including web shells, modified content, or unauthorized database access.
Technical Details
CVE-2019-10068 is an insecure deserialization vulnerability in Kentico Xperience (formerly Kentico CMS), a .NET-based content management platform. The vulnerability exists because Kentico processes serialized .NET objects from untrusted sources without properly validating the types being deserialized. An attacker can craft a malicious serialized object using known .NET deserialization gadget chains (such as those generated by the ysoserial.net tool) and send it to a vulnerable Kentico endpoint. When the server deserializes the payload, the embedded gadget chain executes arbitrary code with the privileges of the web application process. The vulnerability does not require authentication, as the deserialization occurs in a component accessible to unauthenticated users.
Frequently Asked Questions
Is CVE-2019-10068 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2019-10068. Public exploit tools for .NET deserialization are available, and the EPSS score of 97.3% confirms near-certain exploitation.
What products are affected by CVE-2019-10068?
CVE-2019-10068 affects Kentico Xperience (formerly Kentico CMS) versions prior to 12.0.15. Kentico is a .NET-based enterprise content management and digital experience platform.
How do I fix CVE-2019-10068?
Upgrade to Kentico Xperience version 12.0.15 or later. If an immediate upgrade is not possible, apply the vendor-provided hotfix and restrict network access to the Kentico instance.
How severe is CVE-2019-10068?
CVE-2019-10068 is a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code on the server. The enterprise nature of Kentico deployments means that compromise can expose significant amounts of sensitive business and customer data.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.