Full Report
Threat actors have been exploiting a zero-day vulnerability in legacy Sitecore deployments to deploy WeepSteel reconnaissance malware. [...]
Analysis Summary
# Vulnerability: Sitecore ViewState Deserialization Zero-Day Exploited in the Wild
## CVE Details
- CVE ID: CVE-2025-53690
- CVSS Score: Not specified in the text, but implied High based on RCE and active exploitation.
- CWE: CWE-502 (Deserialization of Untrusted Data) due to leveraging a known/reused key.
## Affected Systems
- Products: Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud.
- Versions: Up to version 9.0, *if* deployed using the sample ASP.NET machine key included in pre-2017 Sitecore documentation.
- Configurations: Deployments using the static, publicly documented ASP.NET machine key configuration, often reused in `web.config`.
- Not Impacted: XM Cloud, Content Hub, CDP, Personalize, OrderCloud, Storefront, Send, Discover, Search, and Commerce Server.
## Vulnerability Description
This is a misconfiguration vulnerability stemming from the reuse of a static, publicly documented ASP.NET machine key provided in pre-2017 Sitecore deployment guides. Because the key was known, attackers could craft valid, malicious `_VIEWSTATE` payloads. When these payloads are sent to an unauthenticated endpoint containing a vulnerable ViewState field (specifically observed targeting `/sitecore/blocked.aspx`), the server deserializes the payload, leading to Remote Code Execution (RCE) under the context of the IIS NETWORK SERVICE account.
## Exploitation
- Status: Exploited in the wild (used to deploy WeepSteel reconnaissance malware).
- Complexity: Low (Attacker only needs knowledge of the reused machine key).
- Attack Vector: Network (Remote, unauthenticated access to a specific endpoint).
## Impact
- Confidentiality: High (Information gathering via WeepSteel including system/network data, credential dumping attempted).
- Integrity: High (Execution of arbitrary code, privilege escalation).
- Availability: Medium to High (Deployment of tools like Earthworm capable of tunneling/proxying).
## Remediation
### Patches
- Specific patches are not detailed, but the core fix is replacing the static machine key. Sitecore published a security bulletin (KB1003865).
### Workarounds
1. Immediately replace all static values in `web.config` with new, **unique** machine keys.
2. Ensure the `<machineKey>` element inside `web.config` is **encrypted**.
3. Implement ongoing security: Adopt regular static machine key rotation as a general best practice.
## Detection
- Indicators of Compromise (IoCs): Presence of WeepSteel (reconnaissance malware), network traffic resembling ViewState responses containing non-standard data, execution of reconnaissance commands (`whoami`, `hostname`, `ipconfig /all`), deployment of Earthworm or Dwagent.
- Detection Methods and Tools: Monitoring IIS logs on `/sitecore/blocked.aspx` for requests containing crafted `_VIEWSTATE` parameters. Analyzing processes running under the `NETWORK SERVICE` account for unauthorized activity.
## References
- Vendor Advisories: Sitecore Security Bulletin (KB1003865)
- Relevant Links:
- Mandiant analysis: hxxps://cloud[.]google[.]com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability/
- General Machine Key protection guidance: hxxps://support[.]sitecore[.]com/kb?id=kb_article_view&sysparm_article=KB1003835