CVE-2022-50686

Executive Summary

CVE-2022-50686 is an information disclosure vulnerability in Kentico Xperience, a .NET-based content management system. The flaw resides in the Portal Engine form control error handling mechanism. When a form control encounters an error, the system may return verbose stack trace details to the user. This exposure of internal system information, including file paths, database query structures, and application logic, can aid an attacker in reconnaissance and subsequent targeted attacks. The vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information). No public proof-of-concept (PoC) exploit or patch details are currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for internal reconnaissance.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary .NET CMS platform. Supply chain risk is limited to the Kentico ecosystem and custom modules.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The error messages are delivered over HTTP.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated users can trigger the error.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Stack traces can reveal sensitive internal paths, database schemas, and application secrets.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: Medium to High. While no active exploitation is reported, the information disclosure can significantly lower the barrier for further attacks.

Deep Dive & Mechanics

The vulnerability exists in the Kentico Xperience Portal Engine, which uses ASP.NET Web Forms. When a form control (e.g., a text box, dropdown, or custom widget) fails validation or encounters a runtime error, the default ASP.NET error handling may be misconfigured. Instead of returning a generic error page, the system returns a detailed stack trace.

Technical Flow:

1. An attacker sends a crafted HTTP request to a page that uses a Portal Engine form control.
2. The request contains malformed data (e.g., invalid input type, out-of-range values, or special characters).
3. The form control's OnError or Validate method throws an unhandled exception.
4. The ASP.NET pipeline, if customErrors mode is set to Off or RemoteOnly, returns the full exception details.
5. The response includes:
   • Exception type and message.
   • Full call stack with file paths (e.g., C:\inetpub\wwwroot\Kentico\CMS\Controls\...).
   • Source code snippets (if debug mode is enabled).
   • Database query strings (if the error originates from data access).

Root Cause: Improper error handling configuration in the web.config file or within the Kentico application code. The customErrors setting should be set to On for production environments.

Vulnerable vs. Patched Code

Since no official patch is available, the fix is configuration-based.

Vulnerable Configuration (web.config):

<system.web>
    <customErrors mode="Off" />
    <!-- or -->
    <customErrors mode="RemoteOnly" defaultRedirect="GenericErrorPage.htm">
        <error statusCode="500" redirect="ErrorPage.aspx"/>
    </customErrors>
</system.web>

Patched Configuration (web.config):

<system.web>
    <customErrors mode="On" defaultRedirect="GenericErrorPage.htm">
        <error statusCode="500" redirect="ErrorPage.aspx"/>
    </customErrors>
</system.web>

Additionally, in the Kentico administration, ensure that "Display detailed error messages" is unchecked under Settings -> System -> Debug.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Extract sensitive information from stack traces.

Lab Setup:

• Target: A Kentico Xperience instance (version 13.0 or earlier) with default error handling.
• Tool: Burp Suite, curl, or a simple Python script.

Exploitation Steps:

1. Identify a page that uses a Portal Engine form control (e.g., a login form, registration form, or custom widget).
2. Send a malformed request. For example, if the form expects an integer, send a string.

   POST /login.aspx HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   username=admin&password=test&age=notanumber
   

3. Observe the response. If the vulnerability exists, the server will return a 500 error with a detailed stack trace.
4. Parse the stack trace for:
   • Physical file paths (e.g., C:\inetpub\wwwroot\Kentico\CMS\...).
   • Database connection strings (if exposed).
   • Internal class names and methods.
   • SQL queries (if the error is from data access).

Example Response Snippet:

[HttpException]: Input string was not in a correct format.
   at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
   at System.Convert.ToInt32(String value)
   at CMS.PortalEngine.FormControls.TextBoxControl.Validate() in C:\inetpub\wwwroot\Kentico\CMS\PortalEngine\Controls\TextBoxControl.cs:line 45

Blue Team (Defender)

Detection & Prevention:

1. Configuration Audit: Ensure customErrors is set to On in production.
2. WAF Rules: Block responses containing common stack trace patterns (e.g., at System., in C:\, Exception:).
3. Logging: Enable detailed error logging only to server-side logs, not to the client.
4. Honeypot: Deploy a fake form control that logs any attempts to trigger verbose errors.

Indicators of Compromise (IOCs)

• Network:
  • HTTP 500 responses containing stack trace data.
  • Requests with malformed input to form controls (e.g., non-numeric values in numeric fields).
• Host:
  • Event logs showing unhandled exceptions from CMS.PortalEngine.FormControls.
  • Web server logs with 500 status codes and long response bodies.
• File:
  • Temporary files or logs containing stack trace dumps.

Detection Engineering

YARA Rule

rule CVE_2022_50686_StackTrace_Disclosure {
    meta:
        description = "Detects Kentico Xperience stack trace disclosure in HTTP responses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50686"
    strings:
        $s1 = "at CMS.PortalEngine.FormControls" ascii wide nocase
        $s2 = "in C:\\" ascii wide
        $s3 = "Exception:" ascii wide nocase
        $s4 = "Stack Trace:" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Kentico Xperience Stack Trace Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses containing Kentico stack trace information
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: 
            - 'login.aspx'
            - 'registration.aspx'
        sc-status: 500
        sc-bytes|gte: 1000
        response_body|contains:
            - 'at CMS.PortalEngine.FormControls'
            - 'Stack Trace:'
            - 'Exception:'
    condition: selection
falsepositives:
    - Legitimate debugging sessions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-50686 Kentico Stack Trace Disclosure"; flow:to_server,established; content:"500"; http_stat_code; content:"Stack Trace:"; http_server_body; content:"at CMS.PortalEngine.FormControls"; http_server_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Fix: Set customErrors mode to On in the web.config file.

   <system.web>
       <customErrors mode="On" defaultRedirect="GenericErrorPage.htm" />
   </system.web>
   

2. Configuration Hardening: In the Kentico admin panel, navigate to Settings -> System -> Debug and uncheck "Display detailed error messages".
3. Code Review: Ensure all custom form controls have proper exception handling that does not leak stack traces.
4. WAF Deployment: Use a Web Application Firewall to block responses containing stack trace patterns.
5. Monitoring: Enable logging of all 500 errors and review them for suspicious patterns.
6. Patch: Monitor Kentico's official channels for a security update. If available, apply immediately.

Valters IT