Executive brief
Ajax.NET Professional is a framework used to integrate ASP.NET applications with JavaScript front-ends through automated serialization and RPC-style calls. A vulnerability in how the framework deserializes untrusted data allows attackers to execute arbitrary .NET code on the server. This could lead to complete server compromise, data theft, and service disruption.
Technical details
Ajax.NET Professional is vulnerable to unsafe deserialization of untrusted data, a well-known attack pattern in .NET environments. The framework fails to properly validate or sandbox serialized object instantiation, allowing an attacker to craft malicious serialized payloads that instantiate arbitrary .NET classes with arbitrary constructor arguments. This vulnerability is remotely exploitable over the network without requiring authentication, as the deserialization occurs during request processing. An attacker can achieve remote code execution by leveraging gadget chains (such as those in the .NET Framework or third-party libraries) to achieve code execution during object deserialization. The product appears to be end-of-life or end-of-service, and no patch is expected; users should discontinue use or migrate to supported alternatives.
Affected products
- Ajax.NET Ajax.NET Professional
Timeline
- 2021: disclosed: CVE-2021-23758 assigned
- 2021: exploited: Reported exploited in the wild