Public PoC Released for IIS WebDeploy RCE Vulnerability

Microsoft has confirmed a newly disclosed remote code execution (RCE) vulnerability in its IIS Web Deploy toolchain, tracked as CVE-2025-53772.

The flaw resides in the unsafe deserialization logic of the msdeployagentservice and msdeploy.axd endpoints, allowing authenticated attackers to execute arbitrary code on vulnerable web servers.

As enterprises worldwide rely on Web Deploy for automated deployments, the disclosure of a public proof-of-concept has triggered urgent remediation efforts across the industry.

Technical Breakdown

At the heart of this vulnerability is the deserialization of the MSDeploy.SyncOptions HTTP header.

Web Deploy expects this header to contain a GZip-compressed, Base64-encoded blob, which it decodes, decompresses, and then deserializes via .NET’s BinaryFormatter.

Because BinaryFormatter can instantiate any object present in the serialized stream, an attacker-controlled payload can coerce the server into executing system commands.

The exploit chain typically follows these steps:

1. Authentication: Attacker obtains valid credentials for the Web Management Service (WMSvc) or the Web Deploy Agent Service (MsDepSvc).
2. Payload Generation: A malicious C# payload constructs a serialized object graph (often leveraging delegates such as SortedSet<T> or ObjectDataProvider) that triggers System.Diagnostics.Process.Start.
3. Header Injection: The payload is compressed, encoded, and sent in the MSDeploy.SyncOptions header of an HTTP POST to /msdeploy.axd or via the agent service.
4. Deserialization and Execution: The server processes the header without strict validation, deserializes the payload, and executes commands (e.g., cmd.exe /c calc).

Table 1 summarizes the core components and impact of CVE-2025-53772:

Microsoft’s actor rates this issue at a severity score of 8.8 and urges administrators to apply the latest Web Deploy updates immediately.

Until patches are fully deployed, the following mitigations are recommended:

• Restrict endpoint access via IP allow-lists, VPN tunnels, or firewall rules to limit exposure.
• Enforce least-privilege service accounts for WMSvc and MsDepSvc.
• Monitor IIS logs for anomalous MSDeploy.SyncOptions header usage and large Base64 blobs.
• Disable the MsDepSvc service and remove the /msdeploy.axd handler if not required in your environment.
• Replace BinaryFormatter–based deserialization with secure serializers such as System.Text.Json or implement custom validation.
• Isolate Web Deploy hosts within dedicated bastion servers to reduce lateral movement post-compromise.

CVE-2025-53772 exemplifies the persistent risks posed by unsafe deserialization in modern deployment pipelines.

By promptly applying patches and tightening access controls, organizations can mitigate this critical RCE threat and maintain the integrity of their automated application deployments.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates