nmlz/CVE-2023-35813_PoC

GitHubRepository PoCExploit

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a cURL command that exploits CVE-2023-35813, a remote code execution vulnerability in Sitecore products, by sending a crafted POST request to the /sitecore_xaml.ashx endpoint to execute arbitrary server-side code via the ParseControl method.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file containing a curl command that demonstrates an exploit for CVE-2023-35813 against a Sitecore target. The command sends a POST request with a malicious XAML payload to a target server to achieve remote code execution. The payload is a standard exploit technique for this CVE, and the command is presented as a transparent proof-of-concept. There is no evidence of any backdoor, deceptive payload, or behavior that would harm the operator's machine. The operator is expected to replace the placeholder '[target]' with the actual target host.

ClassificationExploit
Model confidence95%
AuthenticationUnknown
LanguagesShell
Target softwareSitecore Experience ManagerSitecore Experience PlatformSitecore Experience Commerce
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, executable cURL command that sends a crafted HTTP POST request to a vulnerable Sitecore endpoint, injecting a server-side control to achieve remote code execution. This is exploit code, not a scanner or writeup.

readme.md:1-12

Requirements

  • Target must be running a vulnerable version of Sitecore (Experience Manager, Experience Platform, or Experience Commerce through 10.3) with the /sitecore_xaml.ashx endpoint exposed.readme.md:1

Observed behavior

  • Sends a POST request to the /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index endpoint with parameters that inject a server-side control via the ParseControl method.readme.md:1-12
  • The injected payload registers a System.Runtime.Remoting.Services.RemotingService control and sets its Context-Response-ContentType property to 'test123', demonstrating the ability to execute server-side code.readme.md:5-12
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://[target]/sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.IndexTarget endpoint for the exploit, with a placeholder for the target host.readme.md:1
Exploit Payload
ParseControl("<%@Register TagPrefix='x' Namespace='System.Runtime.Remoting.Services' Assembly='System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' %> <x:RemotingService runat='server' Context-Response-ContentType='test123' />")Malicious XAML payload exploiting a Sitecore vulnerability to achieve remote code execution on the target server.readme.md:5-12
Review boundaries

What the analysis did not establish

  • The evidence consists of a single cURL command in a readme.md file; no additional exploit logic, scanner logic, or technical analysis is present.
  • The packet reports complete_artifact_coverage as false, but the single text file is fully included; the classification is based solely on the provided command.
  • The review is limited to the single README.md file provided; no other files from the repository were inspected.
  • The validity of the exploit against a real target or the security of the target endpoint is not assessed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1