rxerium/CVE-2025-53690

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects Sitecore instances potentially vulnerable to CVE-2025-53690 by fetching the version XML file, extracting the version number, and checking if it is <= 9.0. It does not perform deserialization or code injection.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Nuclei detection template (CVE-2025-53690.yaml) and a README.md. The template performs a benign HTTP GET to fetch a version file, extracts version numbers using regex, and compares the version to determine if it is vulnerable. The README provides usage instructions and references. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesYAML
Target softwareSitecore Experience ManagerSitecore Experience Platform
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that only checks for the presence and version of Sitecore. It does not contain any code to exploit the deserialization vulnerability (e.g., sending a malicious ViewState payload). The README explicitly describes it as a 'detection template' and the template itself only performs version extraction and comparison.

README.md:7CVE-2025-53690.yaml:1-58

Requirements

  • Target must expose /sitecore/shell/sitecore.version.xml and return a version number matching the regex pattern.CVE-2025-53690.yaml:20-28

Observed behavior

  • Sends an HTTP GET request to /sitecore/shell/sitecore.version.xml.CVE-2025-53690.yaml:18-20
  • Extracts the first two digits of the version number from the response body using regex.CVE-2025-53690.yaml:22-37
  • Constructs a major.minor version string and compares it to <= 9.0.CVE-2025-53690.yaml:39-58
  • Matches if the response status is 200, the body contains 'Sitecore Corporation', and the version is <= 9.0.CVE-2025-53690.yaml:45-58
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
{{BaseURL}}/sitecore/shell/sitecore.version.xmlTarget path for the detection request; standard Nuclei template behavior.CVE-2025-53690.yaml:20
Regex
\b(\d)(\d)\d{6,}\bRegex used to extract major and minor version digits from the response body.CVE-2025-53690.yaml:28CVE-2025-53690.yaml:36
Dsl Expression
compare_versions(version, "<= 9.0")DSL matcher that checks if the extracted version is vulnerable; standard Nuclei functionality.CVE-2025-53690.yaml:58
Review boundaries

What the analysis did not establish

  • One file (total 3) was omitted from the packet; its content is unknown.
  • The evidence packet reports complete_artifact_coverage is false, so the full repository content is not available.
  • One file (metadata only, not analyzed) was omitted from the evidence; its content is unknown.
  • Binary files were flagged but not present in the selected text evidence.
  • The review is limited to the supplied text content and does not assess the safety of the referenced external URLs or the Nuclei tool itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1