Sitecore XP CVE-2025-34511 Post-Authentication File Upload

MetasploitMetasploit exploitExploitRubyexploit_windows/http/sitecore_xp_cve_2025_34511

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-34511, an unrestricted file upload vulnerability in Sitecore PowerShell Extensions, to achieve remote code execution. It first authenticates using hardcoded credentials (CVE-2025-34509), then uploads an ASPX webshell containing a payload executable, and finally triggers the webshell.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2025-34511. It authenticates with hardcoded credentials (CVE-2025-34509), uploads a generated ASPX payload via the vulnerable PowerShell extension endpoint, and triggers it. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagesruby
Target softwareSitecore PowerShell ExtensionsSitecore Experience Platform
Attack typesremote code executionfile uploadauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by uploading a malicious file and executing it to gain a session. It includes authentication, file upload, and trigger logic, which constitutes exploitation, not just detection or analysis.

modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:6modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:84-130

Requirements

  • Target must be running a vulnerable version of Sitecore PowerShell Extensions (through 7.0) on Sitecore XP 10.0.0 to 10.4.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:79
  • The module authenticates using hardcoded credentials for the ServicesAPI account (username 'ServicesAPI', password 'b') via CVE-2025-34509.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119

Observed behavior

  • Authenticates to the target Sitecore instance using the hardcoded ServicesAPI credentials.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119
  • Generates a payload executable and wraps it in an ASPX webshell.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:87-88
  • Uploads the ASPX webshell via a multipart POST request to the vulnerable PowerShellUploadFile2.aspx endpoint.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:90-104
  • Triggers the uploaded webshell by sending a GET request to its location, executing the payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:111-116
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credential Use
ServicesAPI / bThe module uses hardcoded credentials to authenticate, which is part of the documented exploit chain (CVE-2025-34509). This is normal exploit behavior, not a backdoor.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119
Payload Generation
generate_payload_exe + to_exe_aspxThe module generates a payload executable and wraps it as an ASPX webshell, which is standard Metasploit behavior for achieving remote code execution on the target.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:87-88
File Upload Endpoint
/sitecore%20modules/Shell/PowerShell/UploadFile/PowerShellUploadFile2.aspxThe module uploads the generated ASPX file to the vulnerable PowerShell extension endpoint, consistent with the CVE description.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:72modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:100
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins (e.g., Msf::Exploit::Remote::HTTP::SitecoreXp, Msf::Exploit::CmdStager) are not expanded, so exact HTTP request construction and payload staging details are not fully visible.
  • The module was not executed; classification is based on static analysis of the provided Ruby code.
  • Only the module source is reviewed; the behavior of included Metasploit mixins (Msf::Exploit::Remote::HTTP::SitecoreXp, Msf::Exploit::CmdStager) and the generated payload are not expanded or analyzed.
  • Binary files are flagged as metadata-only and not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1