CVE-2021-23758
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Description
CVE-2021-23758 is a high-severity deserialization of untrusted data vulnerability affecting all versions of the ajaxpro.2 package and Ajax.NET Professional before 21.10.30.1. The library permits deserialization of arbitrary .NET classes, which an attacker can abuse to achieve remote code execution on the web server hosting the affected component. Because Ajax.NET Professional is an older AJAX framework embedded in long-lived .NET web applications, many affected deployments are legacy systems whose owners may not know the library is present. CVE-2021-23758 carries a CVSS score of 8.1 and an exceptional EPSS score of roughly 84% at the 99th percentile, public exploit code is available, and Cisco Talos has documented its use by a Chinese-speaking adversary — CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a deadline of 9 September 2026.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ajaxpro.2 project | ajaxpro.2 | All versions |
| michaelschwarz | ajax.net professional | < 21.10.30.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html(Exploit, VDB Entry)
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57(Patch, Third Party Advisory)
- https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971(Third Party Advisory)
- https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of untrusted data occurs when an application reconstructs objects from a serialized input without sufficiently verifying that the result will be valid and safe. Because deserialization can instantiate arbitrary types and invoke their initialisation logic, an attacker who controls the serialized payload effectively controls which code the process runs. In CVE-2021-23758 Ajax.NET Professional deserializes arbitrary .NET classes from request data, so an attacker can select a gadget type whose construction chain ends in command execution.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2021-23758 is remotely exploitable over the network with no authentication and no user interaction, though attack complexity is High because the attacker must identify a suitable gadget chain available in the target application's loaded assemblies — a requirement that well-known .NET gadget catalogues have largely eliminated in practice. When exploitation succeeds the impact is high across confidentiality, integrity and availability: code executes in the context of the web application process, exposing configuration files, connection strings and any data the application can reach, allowing modification of application behaviour and the installation of web shells, and permitting the service to be taken offline. Because the affected library typically sits inside internal or perimeter-facing business applications, the compromised server is often a stepping stone into the internal network rather than the final objective. The CVSS 3.1 base score is 8.1 (High), but the EPSS score of approximately 84% in the 99th percentile is the figure that matters — it indicates near-certain ongoing exploitation.
Exploit Maturity
CVE-2021-23758 is at the very top of the exploit maturity scale. Public exploit code is available via Packet Storm Security, which publishes a working AjaxPro deserialization remote code execution exploit, and the upstream fix commit is public for patch diffing. Cisco Talos has published research on UAT-10147, a Chinese-speaking adversary integrating agentic AI into post-compromise operations, tagged as exploit material and documenting this vulnerability's use by an organised threat actor. Most striking is the EPSS score of roughly 84%, placing it in the 99th percentile — among the very highest exploitation probabilities assigned to any vulnerability and a clear statement that attacks are continuous rather than sporadic. The KEV ransomware flag is "Unknown", but with a public exploit, documented adversary use and a five-year-old patch, any application still shipping AjaxPro should be assumed compromised until proven otherwise.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with vendor instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 9 September 2026 has passed.
- Upgrade Ajax.NET Professional to 21.10.30.1 or later. The upstream fix commit addresses the unsafe deserialization; note that all versions of the
ajaxpro.2NuGet package are affected, so a dependency on that package must be replaced rather than merely bumped. - Inventory your estate for the library. Because this is an old component, the hardest part of remediation is discovery: search build manifests,
packages.config,bindirectories and deployed applications forAjaxPro,ajaxpro.2and the AjaxPro HTTP handler registration inweb.config, and check third-party and vendor-supplied .NET applications as well as your own code. - Block or remove the AjaxPro handler where upgrading is not immediately possible. Remove the AjaxPro HTTP handler mapping from
web.configif the functionality is unused, or block requests to the AjaxPro endpoint paths at the reverse proxy or WAF — since exploitation requires reaching the deserialization endpoint, cutting that path is effective containment. - Hunt for compromise and harden long term. Inspect web servers for web shells and unexpected files in application directories, review IIS logs for POST requests to AjaxPro endpoints carrying unusually large or encoded payloads, check for new scheduled tasks, services and outbound connections, and rotate application and database credentials; then apply the general defence for this weakness class — avoid deserializing data from untrusted sources at all, prefer JSON or other text formats with explicitly typed models over binary or type-embedding serializers, and where deserialization is unavoidable restrict it with a strict allowlist of permitted types.
Technical Details
CVE-2021-23758 is a deserialization of untrusted data flaw (CWE-502) in Ajax.NET Professional. The library's purpose is to marshal calls between browser JavaScript and server-side .NET methods, which requires reconstructing .NET objects from request payloads. The defect is that the deserializer permits arbitrary .NET classes rather than restricting reconstruction to the types a given endpoint legitimately expects. An attacker supplies a payload naming a "gadget" type — a class already present in the application's loaded assemblies whose constructor, property setters or deserialization callbacks perform side effects — and chains those side effects into process command execution. No memory corruption is involved; the attack is entirely a matter of making the application's own type system do the work, which is why such flaws are reliable across operating systems and hardening measures. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H records an unauthenticated, network-reachable attack with no user interaction but High attack complexity, reflecting the need to find a viable gadget chain in the target's specific assembly set, and complete impact on confidentiality, integrity and availability at unchanged scope.
Frequently Asked Questions
Is CVE-2021-23758 being actively exploited?
Yes, heavily. CISA lists CVE-2021-23758 in its Known Exploited Vulnerabilities catalog with a remediation deadline of 9 September 2026 that has passed, public exploit code for AjaxPro deserialization remote code execution is available on Packet Storm Security, and Cisco Talos has documented its use by the Chinese-speaking adversary UAT-10147. Its EPSS score of about 84% sits in the 99th percentile.
What products are affected by CVE-2021-23758?
All versions of the ajaxpro.2 package are affected, as is Michael Schwarz's Ajax.NET Professional before version 21.10.30.1. The practical difficulty is discovery: the library is embedded in many legacy .NET web applications, including vendor-supplied ones, so an inventory of deployed assemblies and web.config handler registrations is required.
How do I fix CVE-2021-23758?
Upgrade Ajax.NET Professional to 21.10.30.1 or later, and replace any dependency on the ajaxpro.2 package, since all of its versions are affected. Where an immediate upgrade is impossible, remove the AjaxPro HTTP handler from web.config or block its endpoints at the WAF, then hunt for web shells and rotate application and database credentials.
How severe is CVE-2021-23758?
CVE-2021-23758 is rated High with a CVSS 3.1 base score of 8.1. It is unauthenticated and network-exploitable with no user interaction and yields remote code execution with full confidentiality, integrity and availability impact; attack complexity is rated High because a suitable .NET gadget chain must be found, but public exploit code removes that obstacle in practice, and an EPSS score in the 99th percentile makes it an emergency priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.