CVE-2024-58320

Executive Summary

CVE-2024-58320 is an information disclosure vulnerability in Kentico Xperience, a content management system (CMS). The flaw allows unauthenticated public users to access sensitive administration interface hostname details during the authentication process. By querying a public endpoint, attackers can retrieve confidential hostname configuration information, potentially exposing internal network topology and aiding further reconnaissance. No proof-of-concept (PoC) code, exploit, or patch is currently available. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS probability of 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch and the potential for internal network exposure warrant immediate attention.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Kentico Xperience CMS, which is a proprietary .NET-based platform. Organizations using Kentico Xperience should review their deployment for exposure of the authentication endpoint and apply network-level controls.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: Low (based on EPSS 0.0% and no known exploits)

Deep Dive & Mechanics

The vulnerability resides in the authentication endpoint of Kentico Xperience. During the login process, the application inadvertently exposes hostname configuration details (e.g., internal server names, IP addresses, or DNS records) in the response to unauthenticated requests. This information is typically intended for administrative use only. Attackers can enumerate these details by sending crafted requests to the public authentication endpoint, such as /CMSPages/Logon.aspx or similar paths. The exposed data may include internal hostnames, load balancer addresses, or backend server identifiers, which can be used to map the internal network and plan further attacks.

The root cause is likely improper access control or error handling in the authentication logic, where sensitive configuration data is returned in HTTP headers, response bodies, or error messages without proper authorization checks.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable behavior can be described:

Vulnerable Code (Conceptual):

// Example of vulnerable authentication endpoint
public ActionResult Logon() {
    var config = GetAdminConfiguration();
    // Exposes hostname in response header
    Response.Headers.Add("X-Kentico-Host", config.Hostname);
    return View();
}

Patched Code (Expected):

// Patched version should remove or restrict sensitive headers
public ActionResult Logon() {
    // No exposure of hostname
    return View();
}

The fix would involve removing any disclosure of internal hostnames from public endpoints and ensuring that only authenticated administrators can access such configuration data.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify Kentico Xperience instances by scanning for common paths like /CMSPages/Logon.aspx or /Kentico/Login.
2. Exploitation: Send an unauthenticated GET request to the authentication endpoint and inspect the response for hostname information.

   curl -v http://target.com/CMSPages/Logon.aspx
   

   Look for headers like X-Kentico-Host, Server, or response body containing internal hostnames.
3. Data Extraction: Parse the response to extract hostname details. Use this information to map internal infrastructure.

Blue Team

1. Detection: Monitor for unusual requests to authentication endpoints from unauthenticated sources. Look for patterns of repeated requests to /CMSPages/Logon.aspx or similar.
2. Mitigation: Implement network-level access controls (e.g., WAF rules) to block public access to sensitive endpoints. Use reverse proxy to strip internal headers.
3. Honeypot: Deploy a fake Kentico instance that logs and alerts on such reconnaissance attempts.

Indicators of Compromise (IOCs)

• Network Indicators:
  • HTTP requests to /CMSPages/Logon.aspx or /Kentico/Login from unknown IPs.
  • Responses containing headers like X-Kentico-Host, X-Backend-Server, or internal hostnames.
• File Indicators:
  • Log entries showing GET /CMSPages/Logon.aspx with 200 status codes from unauthenticated users.
• Behavioral Indicators:
  • Repeated scanning of Kentico authentication endpoints from a single IP.

Detection Engineering

YARA Rule

rule Detect_Kentico_Hostname_Disclosure {
    meta:
        description = "Detects Kentico Xperience responses exposing internal hostnames"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58320"
    strings:
        $header = "X-Kentico-Host" nocase
        $body = "Hostname" nocase
        $path = "/CMSPages/Logon.aspx" nocase
    condition:
        any of ($header, $body) and $path
}

Sigma Rule

title: Kentico Xperience Hostname Disclosure Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-58320 by accessing the authentication endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem:
            - '/CMSPages/Logon.aspx'
            - '/Kentico/Login'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin logins (should be rare from public IPs)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-58320 Kentico Xperience Hostname Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/CMSPages/Logon.aspx"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the authentication endpoint using a Web Application Firewall (WAF) or reverse proxy.
   • Remove or obfuscate any internal hostname information from HTTP responses.
   • Monitor logs for unauthorized access attempts.

2. Long-term Fix:

   • Apply vendor patch when available (currently UNKNOWN).
   • Implement proper access controls to ensure sensitive configuration data is only exposed to authenticated administrators.
   • Conduct a security audit of all public endpoints for similar information disclosure issues.

3. Workarounds:

   • Use custom error pages to prevent leakage of internal details.
   • Disable directory listing and verbose error messages.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert