Sitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_windows/http/sitecore_xp_cve_2025_34510

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-34510 (Zip Slip) and CVE-2025-34509 (hardcoded credentials) to achieve remote code execution on Sitecore XP. It authenticates with hardcoded credentials, uploads a malicious ZIP archive containing a path traversal payload, and triggers the webshell.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2025-34510. It authenticates using hardcoded credentials (CVE-2025-34509), uploads a ZIP archive containing a path traversal payload to write an ASPX webshell, and triggers it. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagesruby
Target softwareSitecore Experience PlatformSitecore Experience ManagerSitecore Experience Commerce
Attack typesremote code executionpath traversalauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by authenticating, uploading a malicious ZIP with a path traversal payload, and executing arbitrary code on the target.

modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:1-352

Requirements

  • Target must be running a vulnerable version of Sitecore (9.0-9.3, 10.0-10.4) with the hardcoded ServicesAPI credentials active.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:22modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:70-72

Observed behavior

  • Authenticates to the target using hardcoded credentials ('ServicesAPI' / 'b') via the login_identitysrv method.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:340
  • Elevates privileges by obtaining identity cookies via get_identity_cookies.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:66modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:344
  • Navigates a multi-step upload wizard (Upload2.aspx) to prepare for a ZIP upload with the 'Unzip' option enabled.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:88-297
  • Generates a malicious ZIP archive containing a path traversal filename ('//\\/../' + webshell_file) and an ASPX webshell payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:299-307
  • Uploads the malicious ZIP via a multipart POST request, exploiting the Zip Slip vulnerability to write the webshell to an arbitrary location.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:309-325
  • Triggers the uploaded webshell by sending a GET request to the webshell's URL, executing the payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:332-336modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:350
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credential
ServicesAPI / bUsed for authentication as part of the exploit chain (CVE-2025-34509). This is the documented vulnerability, not a backdoor.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:340
Path Traversal Payload
//\/../<random>.aspxThe ZIP slip path traversal writes an ASPX webshell to the web root. This is the core exploit mechanism.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:301-305
Payload Generation
generate_payload_exe + to_exe_aspxStandard Metasploit payload generation; the resulting executable is embedded in the ASPX webshell.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:302-303
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins (e.g., Msf::Exploit::Remote::HTTP::SitecoreXp, login_identitysrv, get_identity_cookies) are not expanded, so exact authentication and cookie elevation logic is not visible.
  • The generated payload (generate_payload_exe, to_exe_aspx) depends on Metasploit's payload generation framework, which is not included in the evidence.
  • No network traffic or runtime behavior was observed; classification is based on static code analysis of the module's intended operation.
  • Only the module source file is reviewed; framework mixins (Msf::Exploit::Remote::HTTP::SitecoreXp, HttpClient, CmdStager) and the generated payload are not expanded or inspected.
  • Binary content of the generated ZIP and ASPX payload is not analyzed; the review relies on the source code logic.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1