Hard-Coded 'b' Password in Sitecore XP Sparks Major RCE Risk in Enterprise Deployments
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-9874 +1 in the same advisory: …9875 | Unauthenticated .NET Deserialization RCE in Sitecore CMS and Experience Platform CVE-2019-9874 is a deserialization flaw (CWE-502) in the Sitecore.Security.AntiCSRF module that lets an unauthenticated attacker run arbitrary code remotely. It is triggered by sending a crafted serialized .NET object in the HTTP POST parameter __CSRFTOKEN, which the module deserializes without validation. Successful exploitation yields full remote code execution with the privileges of the web application, with confidentiality, integrity, and availability all impacted. Users of Sitecore CMS 7.0 through 7.2 and Sitecore Experience Platform (XP) 7.5 through 8.2 are affected. The flaw carries a critical CVSS 3.1 score of 9.8, a very high EPSS score of 83.7%, and was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-26, indicating active exploitation in the wild; ransomware use is currently unknown. Do: Upgrade affected Sitecore CMS (7.0–7.2) and XP (7.5–8.2) deployments to a patched, currently supported release per Sitecore's security guidance, as required by CISA's KEV/BOD 22-01 action for federal agencies. Until patched, restrict network access to vulnerable Sitecore instances and monitor IIS/web logs for unauthenticated POST requests containing oversized or anomalous __CSRFTOKEN values. A public technical advisory with exploitation details is available from Synacktiv, so treat exploitability as confirmed. | 9.8 group max | 84% | KEV PoC |
| largeon the order of tens of thousands of internet-exposed Sitecore CMS/XP deployments (estimated) | |
| CVE-2025-27218 | Insecure Deserialization RCE in Sitecore Experience Manager (XM) and XP 10.4 Sitecore Experience Manager (XM) and Experience Platform (XP) version 10.4, prior to the KB1002844 hotfix, are vulnerable to remote code execution through insecure deserialization, classified under CWE-94 (improper control of code generation). The flaw is reachable over the network with no privileges or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N), and successful exploitation gives an attacker code execution on the affected instance; the published base score is 5.3 (medium). Any organization running XM/XP 10.4 without the KB1002844 fix is affected, and related coverage highlights elevated RCE risk in enterprise deployments as well as a related hard-coded 'b' password issue in Sitecore XP. No exploitation has been documented so far: the flaw is not in CISA KEV and no public proof-of-concept is known. However, EPSS assigns a 65% probability of exploitation within the next 30 days (99th percentile), so defenders should treat near-term exploitation attempts as likely. Do: Apply the Sitecore hotfix KB1002844 to all XM/XP 10.4 instances, or upgrade to a release that includes it, and inventory internet-facing Sitecore servers to confirm none remain unpatched. Until patched, restrict network exposure of Sitecore servers and monitor for exploitation attempts given the 65% EPSS. Also review related coverage of the hard-coded 'b' password issue in Sitecore XP and apply any associated vendor guidance. | 5.3 | 65% |
| largeon the order of tens of thousands of internet-exposed Sitecore systems (10.4 pre-hotfix subset) | ||
| CVE-2025-34511 | Unrestricted File Upload RCE in Sitecore PowerShell Extensions (SPE) Sitecore PowerShell Extensions (SPE), a widely installed administrative add-on for Sitecore Experience Manager (XM) and Experience Platform (XP), contains an unrestricted file upload flaw (CWE-434) in all versions through 7.0. A remote attacker with valid low-privileged credentials can send a crafted HTTP request that uploads arbitrary files, such as a webshell, to the web server, which are then executed, yielding remote code execution with high impact on confidentiality, integrity, and availability. Any Sitecore XM, XP, Experience Commerce, or Managed Cloud deployment running the SPE add-on at version 7.0 or earlier is affected, making enterprise CMS operators the primary at-risk population. Exploitation is not yet listed in CISA KEV and no confirmed in-the-wild campaigns are documented, but a public proof-of-concept has been published by WatchTowr, and EPSS assigns a high 22.3% probability of exploitation within 30 days (98th percentile). Researchers have also shown this flaw chained with other Sitecore issues, including a hard-coded credential, to achieve pre-authentication RCE in enterprise deployments. Do: Upgrade Sitecore PowerShell Extensions to a fixed release newer than 7.0 as directed by Sitecore's advisory, prioritizing internet-facing content management and delivery servers. Until patched, restrict access to SPE endpoints (PowerShell services/remoting endpoints) to trusted administrative users with strong authentication. Audit upload directories and web roots for unexpected files or webshells, and confirm the instance is also patched against the related hard-coded-credential Sitecore XP issues researchers chained with this flaw. | 8.8 group max | 22% | PoC |
| largetens of thousands of internet-exposed Sitecore XM/XP/Commerce instances, with a large but unquantified subset running the SPE add-on (exact SPE install count… |
Full article728 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 17, 2025Vulnerability / Enterprise Software
Cybersecurity researchers have disclosed three security flaws in the popular Sitecore Experience Platform (XP) that could be chained to achieve pre-authenticated remote code execution.
Sitecore Experience Platform is an enterprise-oriented software that provides users with tools for content management, digital marketing, and analytics and reports.
The list of vulnerabilities is as follows -
- CVE-2025-34509 (CVSS score: 8.2) - Use of hard-coded credentials
- CVE-2025-34510 (CVSS score: 8.8) - Post-authenticated remote code execution via path traversal
- CVE-2025-34511 (CVSS score: 8.8) - Post-authenticated remote code execution via Sitecore PowerShell Extension
watchTowr Labs researcher Piotr Bazydlo said the default user account "sitecore\ServicesAPI" has a single-character password that's hard-coded to "b." In its documentation, Sitecore advises customers against changing default user account credentials.
While the user has no roles and permissions assigned in Sitecore, the attack surface management firm found that the credentials could be alternately used against the "/sitecore/admin" API endpoint to sign in as "sitecore\ServicesAPI" and obtain a valid session cookie for the user.
"While we can't access 'Sitecore Applications' (where a significant portion of functionality is defined) as the ServicesAPI has no roles assigned, we can still: (1) Access a number of APIs, and (2) Pass through IIS authorization rules and directly access some endpoints," Bazydlo explained.
This, in turn, opens the door to remote code execution via a zip slip vulnerability that makes it possible to upload a specially crafted ZIP file via the "/sitecore/shell/Applications/Dialogs/Upload/Upload2.aspx" endpoint and causes the archive's contents (e.g., a web shell) to be written to the webroot directory.
The entire sequence of actions is listed below -
- Authenticate as the "sitecore\ServicesAPI" user
- Access Upload2.aspx
- Upload a ZIP file, which contains a web shell called /\/../<web_shell>
- When prompted, check the Unzip option and complete the upload
- Access the web shell
The third vulnerability has to do with an unrestricted file upload flaw in PowerShell Extensions that can also be exploited as the "sitecore\ServicesAPI" user to achieve remote code execution through the "/sitecore%20modules/Shell/PowerShell/UploadFile/PowerShellUploadFile2.aspx" endpoint.
watchTowr pointed out that the hard-coded password originates from within the Sitecore installer that imports a pre-configured user database with the ServicesAPI password set to "b." This change, the company said, went into effect starting version 10.1.
This also means that the exploit chain only works if users have installed Sitecore using installers for versions ≥ 10.1. Users are likely not impacted if they were previously running a version prior to 10.1 and then upgraded to a newer vulnerable version, assuming the old database is being migrated, and not the database embedded within the installation package.
With previously disclosed flaws in Sitecore XP coming under active exploitation in the wild (CVE-2019-9874 and CVE-2019-9875), it's essential that users apply the latest patches, if not already, to safeguard against potential cyber threats.
"By default, recent versions of Sitecore shipped with a user that had a hard-coded password of 'b.' It's 2025, and we can't believe we still have to say this, but that's very bad," Benjamin Harris, CEO and founder of watchTowr, told The Hacker News in a statement.
"Sitecore is deployed across thousands of environments, including banks, airlines, and global enterprises – so the blast radius here is massive. And no, this isn't theoretical: we've run the full chain, end-to-end. If you're running Sitecore, it doesn’t get worse than this – rotate creds and patch immediately before attackers inevitably reverse engineer the fix."
Update
When reached for comment, a Sitecore spokesperson shared the following statement with The Hacker News: "We are aware of the recent report from watchTowr identifying several vulnerabilities in our software. We have actively collaborated with them to address the issue and have published a Knowledge Base article with details of patches and steps to remediate."
The company also pointed out it has remediated a previous finding from watchTowr in February 2025 (CVE-2025-27218, CVSS score: 5.3), which it said had been fixed in December 2024.
"Our customer support teams have proactively communicated these updates to our affected clients. All impacted SaaS products have been remediated, and we strongly advise in-scope on-premises customers to promptly apply the provided patches," the spokesperson said.
(The story was updated after publication to include a response from Sitecore.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/06/hard-coded-b-password-in-sitecore-xp.html