CVE-2021-27852
Checkbox Survey Deserialization of Untrusted Data Vulnerability
Description
CVE-2021-27852 is an insecure deserialization vulnerability in Checkbox Survey, a web-based survey management application. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on the server by sending a specially crafted serialized object that the application deserializes without proper validation. CISA has added CVE-2021-27852 to the Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 0.85% (99.4th percentile), this vulnerability is among the most likely to be exploited, representing a critical risk for organizations running Checkbox Survey.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| checkbox | survey | < 7.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.kb.cert.org/vuls/id/706695(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27852(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 describes a weakness where software deserializes untrusted data without sufficient verification that the resulting data is valid and safe. In CVE-2021-27852, Checkbox Survey deserializes user-supplied data from HTTP requests without adequate validation, allowing an attacker to inject a malicious serialized object that, upon deserialization, executes arbitrary code on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2021-27852 enables unauthenticated remote code execution on Checkbox Survey servers, granting attackers complete control over the application and its underlying server infrastructure. The confidentiality impact is critical — attackers can access all survey data, respondent information, and any credentials or sensitive configuration stored on the server. The integrity impact allows modification of survey content, injection of malicious scripts into survey pages, and deployment of backdoors for persistent access. Availability can be fully compromised through ransomware deployment or server destruction. As a web application vulnerability requiring no authentication, any internet-facing Checkbox Survey instance is a direct target.
Exploit Maturity
CVE-2021-27852 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 0.85% (99.4th percentile) places it among the most likely vulnerabilities to be exploited. Deserialization vulnerabilities in .NET applications like Checkbox Survey are well-understood by attackers, and tools like ysoserial.net provide ready-made payload generators that simplify exploitation. The unauthenticated attack surface makes this vulnerability particularly attractive for opportunistic mass scanning campaigns.
Remediation
- Apply Checkbox Survey patches immediately as required by CISA KEV: update to the latest version that addresses the insecure deserialization vulnerability.
- If patching is not immediately possible, restrict network access to the Checkbox Survey application to trusted IP ranges only.
- Implement a web application firewall (WAF) with deserialization attack signatures to provide defense-in-depth while patching is underway.
- Audit the Checkbox Survey server for indicators of compromise, including unauthorized files, web shells, modified survey configurations, and unexpected network connections.
- Review all survey data for evidence of tampering and notify affected respondents if data integrity cannot be confirmed.
Technical Details
CVE-2021-27852 is an insecure deserialization vulnerability in Checkbox Survey, a .NET-based web application for survey management. The application accepts serialized .NET objects from HTTP request parameters and deserializes them using an insecure deserialization mechanism without proper type validation or allow-listing. An attacker can craft a malicious serialized payload using known .NET deserialization gadget chains (such as those generated by ysoserial.net) that, when deserialized by the server, trigger arbitrary code execution with the privileges of the web application process. The attack requires no authentication, as the vulnerable endpoint processes deserialization before any authentication checks.
Frequently Asked Questions
Is CVE-2021-27852 being actively exploited?
Yes. CVE-2021-27852 is listed in the CISA KEV catalog with confirmed active exploitation. The EPSS score of 0.85% (99.4th percentile) confirms extremely high exploitation probability.
What products are affected by CVE-2021-27852?
CVE-2021-27852 affects Checkbox Survey, a .NET-based web survey management application. Organizations running vulnerable versions are at risk of unauthenticated remote code execution.
How do I fix CVE-2021-27852?
Update Checkbox Survey to the latest patched version. Restrict network access to the application and implement WAF rules to block deserialization attacks as interim protection.
How severe is CVE-2021-27852?
CVE-2021-27852 is a critical unauthenticated remote code execution vulnerability. Its 99.4th percentile EPSS score confirms it as one of the most exploited web application vulnerabilities, and the deserialization attack vector makes exploitation straightforward with available tools.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.