CVE-2023-35813

CRITICALNuclei

Experience Manager, Experience Platform, and Experience Commerce Remote Code Execution

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-35813 has a selected CVSS score of 9.8 (critical); EIP currently links 5 repository PoCs and 1 Nuclei template.

Description

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
5
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 17, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

experience_commerce

Browse Sitecore / experience_commerce
VulnCheckVersion data not supplied

Proofs of concept

5

Repository PoCs

GitHubher3ticAVI/CVE-2023-35813Repository PoCby her3ticAVI3Scanner3 files

13.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends a crafted POST request to a Sitecore endpoint and checks the Content-Type response header for a specific string to determine if the target is vulnerable to CVE-2023-35813.

Backdoor review

No backdoor observed in reviewed code

The PoC script sends a crafted HTTP POST request to a target Sitecore instance and checks the Content-Type response header for a specific string to determine vulnerability. No backdoor, persistence, credential theft, or unrelated payload delivery is observed. The script performs only the described vulnerability check.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareSitecore Experience ManagerSitecore Experience PlatformSitecore Experience Commerce
Attack typesremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only sends a request and inspects the response header to detect vulnerability; it does not execute a payload to gain code execution or establish a shell. The README describes it as a tool to 'determine if an instance of Sitecore is vulnerable'.

CVE-2023-35813.py:12-16README.md:2

Requirements

  • Target must be a Sitecore instance with the /sitecore_xaml.ashx endpoint accessible.CVE-2023-35813.py:29

Observed behavior

  • Sends an HTTP POST request to the target's /sitecore_xaml.ashx endpoint with a payload containing a .NET RemotingService tag that sets the Context-Response-ContentType to 'payload withheld'.CVE-2023-35813.py:29-34
  • Checks if the string 'payload withheld' is present in the Content-Type header of the HTTP response.CVE-2023-35813.py:39-41
  • Prints a message indicating whether the host is vulnerable or not based on the header check.CVE-2023-35813.py:42-48
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldTarget endpoint for the CVE-2023-35813 vulnerability check.CVE-2023-35813.py:29
Http Header Check
Payload withheldString checked in the Content-Type response header to confirm vulnerability.CVE-2023-35813.py:41
Review boundaries

What the analysis did not establish

  • One file (likely a license or config) is omitted from the packet; its content is not available for analysis.
  • The analysis is based solely on static review of the provided source code; the code was not executed.
  • One text file (total 3 files) was omitted from the evidence packet; its content is unknown.
  • Binary files were not analyzed; none were identified in the packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubRezy-Dev/CVE-2023-35813Repository PoCby Rezy-Dev0Scanner2 files

22.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends crafted HTTP POST requests to a Sitecore target to test for CVE-2023-35813 by attempting to manipulate HTTP response headers (Content-Type, Status Code, Location) and extract database connection strings. It does not execute arbitrary commands or establish a reverse shell; it only detects and reports exposure.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2023-35813. The script sends crafted HTTP requests to a user-supplied target to test for a Sitecore RCE vulnerability and extract connection strings. No backdoor, trojan, or deceptive behavior targeting the person running the PoC was observed. The script performs only the advertised vulnerability testing and does not contain concealed executable payloads, persistence mechanisms, or unrelated remote access.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareSitecore Experience ManagerSitecore Experience PlatformSitecore Experience Commerce
Attack typesremote_code_executioninformation_disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to send crafted requests and check responses for indicators of vulnerability (header manipulation, connection string leakage). It does not contain code to execute arbitrary commands, drop a shell, or otherwise exploit the target beyond detection. The README and script description label it as a 'PoC', but its observable behavior is limited to scanning and validation.

exploit.py:1-6exploit.py:116-133exploit.py:415-472

Requirements

  • Target URL of a Sitecore instanceexploit.py:476

Observed behavior

  • Sends POST requests with a ParseControl payload to inject a custom Content-Type header value and checks if the response Content-Type reflects the injected value.exploit.py:135-168
  • Sends POST requests to attempt to set the HTTP response status code to 302 and verifies the response status code.exploit.py:170-202
  • Sends POST requests to inject a redirect Location header and checks for the presence of the injected URL in the response Location header.exploit.py:204-260
  • Sends POST requests to extract core, master, and web database connection strings by reflecting them in the Content-Type header and parses the response for connection string indicators.exploit.py:262-385
  • Prints a summary of test results and declares the target vulnerable if any test succeeds, but does not perform any action beyond detection and reporting.exploit.py:432-472
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe script sends HTTP POST requests to the target URL and may redirect to the InteractSH URL. These are expected behaviors for a PoC that tests a remote code execution vulnerability.exploit.py:116-133exploit.py:211-212
Credential Extraction
Payload withheldThe script attempts to extract database connection strings (core, master, web) from the target's HTTP response headers. This is part of the advertised PoC functionality to demonstrate information disclosure.exploit.py:262-303exploit.py:305-344exploit.py:346-385
Review boundaries

What the analysis did not establish

  • Evidence consists of two text files (README.md and exploit.py) from a single commit; no binary files, network captures, or execution logs are provided.
  • The script's actual effectiveness or safety cannot be verified from static analysis alone.
  • The review is limited to the supplied text files (README.md and exploit.py). No binary files were present or analyzed. The script's behavior depends on the user-supplied target URL, which is not part of the artifact itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubnmlz/CVE-2023-35813_PoCRepository PoCby nmlz0Exploit1 file

548 B

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a cURL command that exploits CVE-2023-35813, a remote code execution vulnerability in Sitecore products, by sending a crafted POST request to the /sitecore_xaml.ashx endpoint to execute arbitrary server-side code via the ParseControl method.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file containing a curl command that demonstrates an exploit for CVE-2023-35813 against a Sitecore target. The command sends a POST request with a malicious XAML payload to a target server to achieve remote code execution. The payload is a standard exploit technique for this CVE, and the command is presented as a transparent proof-of-concept. There is no evidence of any backdoor, deceptive payload, or behavior that would harm the operator's machine. The operator is expected to replace the placeholder '[target]' with the actual target host.

ClassificationExploit
Model confidence95%
AuthenticationUnknown
LanguagesShell
Target softwareSitecore Experience ManagerSitecore Experience PlatformSitecore Experience Commerce
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, executable cURL command that sends a crafted HTTP POST request to a vulnerable Sitecore endpoint, injecting a server-side control to achieve remote code execution. This is exploit code, not a scanner or writeup.

readme.md:1-12

Requirements

  • Target must be running a vulnerable version of Sitecore (Experience Manager, Experience Platform, or Experience Commerce through 10.3) with the /sitecore_xaml.ashx endpoint exposed.readme.md:1

Observed behavior

  • Sends a POST request to the /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index endpoint with parameters that inject a server-side control via the ParseControl method.readme.md:1-12
  • The injected payload registers a System.Runtime.Remoting.Services.RemotingService control and sets its Context-Response-ContentType property to 'test123', demonstrating the ability to execute server-side code.readme.md:5-12
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldTarget endpoint for the exploit, with a placeholder for the target host.readme.md:1
Exploit Payload
Payload withheldMalicious XAML payload exploiting a Sitecore vulnerability to achieve remote code execution on the target server.readme.md:5-12
Review boundaries

What the analysis did not establish

  • The evidence consists of a single cURL command in a readme.md file; no additional exploit logic, scanner logic, or technical analysis is present.
  • The packet reports complete_artifact_coverage as false, but the single text file is fully included; the classification is based solely on the provided command.
  • The review is limited to the single README.md file provided; no other files from the repository were inspected.
  • The validity of the exploit against a real target or the security of the target endpoint is not assessed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubaalexpereira/CVE-2023-35813Repository PoCby aalexpereira8Not analyzed3 files

7.4 KiB

GitHub
PoC details
GitHubBagheeraAltered/CVE-2023-35813-PoCRepository PoCby BagheeraAltered5Not analyzed5 files

2.5 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALSitecore - Remote Code ExecutionCVSS 9.8

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

Impact

Unauthenticated attackers can execute arbitrary code on Sitecore servers through the XAML parser by injecting malicious ASP.NET markup, potentially compromising the entire content management system and accessing sensitive customer data.

Remediation

Apply Sitecore security patches as outlined in KB1002979 for Experience Manager, Experience Platform, and Experience Commerce versions through 10.3.

WeaknessesCWE-22CWE-23
AuthorsDhiyaneshDk, iamnoooob
Template tagscve2023cvesitecorercevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*
Shodan: title:"Sitecore"
Shodan: http.title:"sitecore"
FOFA: title="sitecore"
Google: intitle:"sitecore"
https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1002979 https://code-white.com/blog/exploiting-asp.net-templateparser-part-1/ https://nvd.nist.gov/vuln/detail/CVE-2023-35813 https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979 https://github.com/BagheeraAltered/CVE-2023-35813-PoC

Source: ProjectDiscovery

References

2