Critical Sitecore CMS Flaws Allow Remote Code Execution

Security researchers from watchTowr Labs have disclosed a devastating vulnerability chain affecting Sitecore Experience Platform, enabling attackers to achieve complete system compromise through HTML cache poisoning and remote code execution.

The vulnerabilities, affecting over 22,000 Sitecore instances globally, demonstrate how seemingly benign cache manipulation can escalate to full administrative control.paste.txt

Pre-Authentication Cache Poisoning

The primary vulnerability, CVE-2025-53693 (WT-2025-0023), exploits unsafe reflection mechanisms in Sitecore XamlPageHandlerFactory to achieve HTML cache poisoning without authentication.

Attackers can target the endpoint GET /-/xaml/Sitecore.Shell.Xaml.WebControl and leverage the AjaxScriptManager control to execute the AddToCache(string cacheKey, string html) method through reflection.paste.txt

The attack utilizes specific HTTP parameters:

• __PARAMETERS=AddToCache("cache_key","<malicious_html>")
• __SOURCE=ctl00_ctl00_ctl05_ctl03 (targeting GlobalHeader control)

This allows attackers to overwrite legitimate cached content with malicious HTML, potentially injecting JavaScript payloads that execute when users visit affected pages.

The vulnerability stems from inadequate input validation in the reflection mechanism that processes XAML control requests.paste.txt

Information Disclosure Enables Targeted Exploitation

The second vulnerability, CVE-2025-53694 (WT-2025-0027), affects the ItemService API when exposed to the internet.

Attackers can enumerate cacheable items and their configuration settings using endpoints like /sitecore/api/ssc/item/search?term=layouts, revealing critical information including cache keys, device names, and vary-by parameters.paste.txt

This information disclosure dramatically reduces the complexity of cache poisoning attacks, as attackers can systematically target specific cache entries rather than attempting brute-force approaches.

The API inadvertently exposes the internal structure of Sitecore’s caching system, including template names, paths, and caching configurations.paste.txt

Deserialization Flaw

The vulnerability chain culminates with CVE-2025-53691 (WT-2025-0019), a post-authentication remote code execution flaw exploiting unsafe deserialization in Sitecore.Convert.Base64ToObject.

The method uses an unrestricted BinaryFormatter to deserialize base64-encoded objects without validation.paste.txt

Attackers with Content Editor permissions can trigger the convertToRuntimeHtml pipeline by crafting malicious HTML containing iframe elements with specific attributes:

xml<iframe id="test" src="poc">
    <test id="test_inner" value="base64-encoded-gadget">
    </test>
</iframe>

The vulnerability resides in the ConvertWebControls.Convert method, which processes iframe elements and calls the dangerous deserialization function with attacker-controlled input, leading to arbitrary code execution.paste.txt

Sitecore released patches in June and July 2025 addressing these critical vulnerabilities.

Organizations running Sitecore Experience Platform should immediately apply available updates and review their ItemService API exposure to prevent exploitation of these severe security flaws.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates