Listen to this Post
How CVE-2021-23758 Works
AjaxPro.2 (also known as Ajax.NET Professional) is a popular AJAX framework for Microsoft ASP.NET that automatically creates proxy JavaScript classes to invoke server‑side methods from the client. The library handles serialized data passed between the client and the server, and in doing so it relies on the .NET deserialization mechanism. The root cause of CVE‑2021‑23758 is that AjaxPro.2 does not properly validate or restrict the types of .NET objects that can be deserialized from incoming HTTP requests. An attacker can craft a malicious serialized payload and send it to any AjaxPro‑enabled endpoint. Because the deserialization process uses the `BinaryFormatter` or similar .NET serialization components that allow arbitrary type instantiation, the attacker can force the application to construct and execute dangerous .NET classes that are present in the application’s classpath. By chaining the `readObject()` methods of various available classes – for example, classes that perform file operations, process creation, or command execution – the attacker can achieve remote code execution on the target web server. The vulnerability is particularly dangerous because the deserialization occurs before any authentication or authorization checks, meaning that even unauthenticated remote attackers can exploit it. The attack vector is typically an HTTP POST request to an `.ashx` or similar AjaxPro handler, with the malicious serialized data placed in the request body or as a parameter. Successful exploitation grants the attacker the same privileges as the ASP.NET application pool (usually `NETWORK SERVICE` or IIS APPPOOL), which often has extensive system access. The vulnerability affects all versions of the `ajaxpro.2` NuGet package prior to the patched releases. The library’s design, which trusts client‑supplied serialized data without adequate type filtering, makes this a classic “deserialization of untrusted data” flaw (CWE‑502). Several proof‑of‑concept exploits and Metasploit modules have been published, demonstrating how to leverage `ObjectDataProvider` or `ActivitySurrogateSelector` gadgets to execute arbitrary operating system commands. The official fix involves implementing a custom `SerializationBinder` that restricts deserialization to a whitelist of safe types, and updating to version 21.10.30.1 or later. Users who cannot immediately upgrade are advised to implement input validation, disable unnecessary AjaxPro endpoints, or use Web Application Firewalls (WAF) to block known malicious payload signatures. The vulnerability was discovered by Hans‑Martin Münch of MOGWAI LABS and assigned a CVSS base score of 8.1 (High) due to the high confidentiality, integrity, and availability impact, although the attack complexity is rated as High because successful exploitation requires knowledge of the target’s classpath and gadget chains.
DailyCVE Form:
Platform: .NET ASP.NET
Version: all <=21.10.30.1
Vulnerability: Insecure Deserialization
Severity: High (8.1)
date: 2021‑12‑03
Prediction: 2021‑11‑29 (patch released)
What Undercode Say:
Analytics:
- CVE ID: CVE‑2021‑23758
- CVSS v3.1: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CWE: CWE‑502 – Deserialization of Untrusted Data
- Exploit availability: Public PoC and Metasploit module
- Affected package: `ajaxpro.2` (NuGet) and `AjaxNetProfessional`
– Fixed in: version 21.10.30.1 (later superseded by 21.11.29.1)
Bash Commands & Codes:
Check if your project uses the vulnerable package
dotnet list package --include-transitive | grep -i ajaxpro
Find all AjaxPro handlers in an IIS site
find /path/to/webapp -name ".ashx" | xargs grep -l "AjaxPro"
Using Metasploit (educational)
use exploit/windows/http/ajaxpro_deserialization_rce
set RHOSTS target_ip
set RPORT 80
set TARGETURI /path/to/ajaxpro.ashx
run
Manual PoC (Python - conceptual)
import requests
payload = "...serialized .NET gadget chain..."
requests.post("http://target/ajaxpro/SomeClass.ashx", data=payload)
Exploit: (Educational Purposes!)
An attacker can leverage the `ObjectDataProvider` class in combination with `ProcessStartInfo` to execute system commands. The serialized payload is typically base64‑encoded and sent within the `__VIEWSTATE` or a custom parameter. The following C snippet illustrates the gadget construction (for research only):
// Gadget chain example (DO NOT USE MALICIOUSLY)
ObjectDataProvider provider = new ObjectDataProvider();
provider.MethodName = "Start";
provider.ObjectInstance = new ProcessStartInfo("cmd.exe", "/c whoami > C:\temp\out.txt");
// Serialize 'provider' using BinaryFormatter and send to the target endpoint.
Public repositories (e.g., CVE-2021-23758-POC) contain full working examples. The Metasploit module automates the process by fingerprinting the target and delivering a compatible payload.
Protection:
- Upgrade to AjaxPro.2 version 21.10.30.1 or later (preferably 21.11.29.1).
- If upgrading is not possible, implement a custom `SerializationBinder` to whitelist only safe types during deserialization.
- Disable or remove unused AjaxPro endpoints (
.ashxhandlers) from the application. - Deploy a Web Application Firewall (WAF) with rules to block serialized .NET payloads (e.g., signatures for
ObjectDataProvider,ActivitySurrogateSelector). - Restrict the permissions of the IIS application pool to the minimum required.
- Monitor logs for unusual deserialization exceptions or unexpected process creations.
Impact:
- Remote Code Execution: An unauthenticated attacker can execute arbitrary operating system commands on the web server, leading to full system compromise.
- Data Breach: Attackers can read, modify, or delete sensitive files, database credentials, and application source code.
- Service Disruption: The attacker can crash the application or deploy ransomware, causing denial of service.
- Lateral Movement: With access to the internal network, the attacker can pivot to other systems and escalate privileges.
- Reputational Damage: Successful exploitation can result in loss of customer trust, regulatory fines, and long‑term business impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
