Kentico CMS Insecure Deserialization RCE

CVE-2019-10068 is a .NET object deserialization vulnerability in the Kentico CMS framework that enables attackers to perform remote code execution and gain unauthorized remote access. A SOAP Action within the staging web service deserialized an XML encoded SOAP message within an element of the actual SOAP body. The program uses the staging service to synchronize changes between servers.A malicious request to the staging service could bypass initial authentication and proceed to deserialize user-controlled.NET object input due to a failure to validate security headers. This deserialization then resulted in unauthenticated remote code execution on the Kentico instance’s server.

Mitigation / Precaution

We suggest you update to Kentico CMS version greater than 12.0.15 to fix this vulnerability.

Written by

Manindar Mohan

Cyber Security Lead Engineer

Manieendar is a dedicated Security Engineer with a wealth of experience in the cybersecurity landscape. He plays a pivotal role at Beagle Security, where he employs his extensive knowledge to safeguard systems against cyber threats. Manieendar's passion for cybersecurity extends beyond his professional role; he actively contributes to the online security community through insightful articles and speaking engagements.