CVE-2021-42237

This PoC exploits CVE-2021-42237, a deserialization vulnerability in Sitecore XP, by sending a malicious XML payload to trigger remote code execution via a crafted `ComparisonComparer` delegate. The payload executes a DNS lookup command to confirm exploitation.

This repository contains a Python script that scans for CVE-2021-42237, a pre-auth RCE vulnerability in Sitecore Experience Platform. It checks for vulnerable versions and tests the vulnerable endpoint (Report.ashx) via GET and POST requests.

This repository contains a functional exploit for CVE-2021-42237, a deserialization vulnerability in Sitecore. The PoC leverages a crafted XML payload to achieve remote code execution (RCE) via a SortedSet deserialization gadget chain.

This repository contains a functional exploit for CVE-2021-42237, a deserialization vulnerability in Sitecore XP. The PoC leverages a crafted XML payload to achieve remote code execution (RCE) via a .NET deserialization gadget chain.

This repository contains a functional exploit for CVE-2021-42237, a deserialization vulnerability in Sitecore. The PoC includes a crafted XML payload that triggers remote code execution via a malicious SortedSet comparator.

This Metasploit module exploits a pre-authentication deserialization vulnerability in Sitecore XP's Report.ashx handler, leading to arbitrary code execution as NT AUTHORITY\NETWORK SERVICE. It uses a crafted XML payload with a TypeConfuseDelegate gadget chain to trigger RCE.