Full Report
Sitecore Experience Platform is a Content Management System (CMS). There are at least 22K public Sitecore instances, making this a fairly impactful target. The HTTP handler XamlPageHandlerFactory has had many issues in the past. This works by internally fetching the handler responsible for page generation. Sitecore will generate the page and initialize every component described in the XAML definition. There are several parameters that can control this dispatch - __SOURCE and __PARAMETERS. Any sort of dynamic dispatch has the potential to go wrong and must be reviewed thoroughly. The gathered handlers iterate over a method and call methodFiltered.Invoke after checking to see if the function is allowed to be called. There are two somewhat similar implementations of this dispatch, but with the type XmlControl as a valid type in the filtering. This second type is only extended by the handler HtmlPage.xaml.xml! Crazily enough, this allows for nesting dispatch calls. To do this, call XmlControl that passes the whitelist check. Then, create the arbitrary XAML handler and call it. So, what can this WebControl actually call? The best primitive they found was AddToCache - this leads to an arbitrary cache poisoning vulnerability that is super bad. Using the first primitive effectively turns this into an authentication bypass, since we could poison any page. While going through the codebase, they found the sink Base64ToObject. After some effort, they found a mechanism to trigger this via an HTML editor API—basic sink-to-source analysis. I enjoyed this cache poisoning issue a lot. This is because finding this primitive through all of the functions took a long time to think through. What's the worst thing that we can reasonably do given the impact we have? Sometimes, the bug is the simple part, and it's the impact that is harder to figure out.
Analysis Summary
As a vulnerability research specialist, I have summarized the key findings related to the documented vulnerability in the Sitecore Experience Platform.
# Vulnerability: HTML Cache Poisoning via Unsafe Reflection in XamlPageHandlerFactory
## CVE Details
- CVE ID: CVE-2025-53693
- CVSS Score: Information missing, but described as leading to severe impact (Cache Poisoning leading to RCE chain).
- CWE: CWE-20 (Improper Input Validation - implied by reflection/dispatch issues)
## Affected Systems
- Products: Sitecore Experience Platform
- Versions: Sitecore Experience Platform 10.4.1 rev. 011628 (and likely other versions utilizing the vulnerable handler).
- Configurations: Any installation utilizing the `Sitecore.Web.UI.XamlSharp.Xaml.XamlPageHandlerFactory` handler.
## Vulnerability Description
The vulnerability resides within the `XamlPageHandlerFactory` HTTP handler, which performs dynamic dispatch based on input parameters like `__SOURCE` and `__PARAMETERS`. Researchers found that a nested dispatch mechanism is possible by exploiting behavior related to the `XmlControl` type, specifically via the `HtmlPage.xaml.xml` handler which extends this type. This safe-checking mechanism can be bypassed by first calling a whitelisted `XmlControl` handler, which then allows for the invocation of an arbitrary XAML handler.
The primary impact identified from this dangerous dispatch primitive was **Arbitrary Cache Poisoning** (via the `AddToCache` primitive). Additionally, this primitive could be chained to achieve **Authentication Bypass** by poisoning pages accessible by other users.
A secondary finding involved triggering a **Base64ToObject** sink via the HTML editor API, suggesting potential for authentication bypass or further data manipulation/RCE under specific conditions.
## Exploitation
- Status: Proof of Concept (PoC) likely available internally, based on detailed technical description. Vulnerability was successfully chained into a Remote Code Execution (RCE) chain.
- Complexity: Medium to High (Requires complex chaining through multiple dispatch layers and specific knowledge of Sitecore handler internals).
- Attack Vector: Network (The handler is reachable pre-authentication via HTTP request path, e.g., `GET /-/xaml/watever`).
## Impact
- Confidentiality: High (If chained with RCE or used to poison sensitive pages).
- Integrity: Critical (Cache poisoning allows modification of content served to potentially all users; RCE implies full system compromise).
- Availability: High (Potential for service disruption through RCE conditions).
## Remediation
### Patches
- Patches addressing this vulnerability were released by Sitecore in **June 2025**.
- Specific remediation information should be sought via Sitecore Support Knowledge Base Articles KB1003667 and KB1003734.
### Workarounds
- No specific workarounds were detailed in the summary, but generally, restricting access to the `/~/xaml/` endpoint (**Web.config** configuration) or employing a Web Application Firewall (WAF) to block known malicious payloads targeting this mechanism would serve as temporary mitigations until patching is complete.
## Detection
- **Indicators of Compromise (IoC):** Look for unusual HTTP requests targeting paths prefixed with `/-/xaml/` or similar handler paths, especially those containing nested XAML dispatch syntax or parameters designed to invoke reflection-based methods like `AddToCache`.
- **Detection Methods and Tools:** Monitor HTTP requests for anomalies in the URL path or parameters directed at Sitecore handlers. Network and host-based intrusion detection systems should flag requests attempting to write to the application cache via unexpected injection points.
## References
- Vendor Advisory 1: hxxps://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
- Vendor Advisory 2: hxxps://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734
- Research Source: Cache Me If You Can (Sitecore Experience Platform Cache Poisoning to RCE) by watchTowr Labs.