A chain of Sitecore Experience Platform (XP) vulnerabilities allows attackers to perform remote code execution (RCE) without authentication to breach and hijack servers. Sitecore is a popular enterprise CMS used by businesses to create and manage content across websites and digital media. Discovered by watchTowr researchers, the pre-auth RCE chain disclosed today consists of three distinct vulnerabilities. It hinges on the presence of an internal user (sitecore\ServicesAPI) with a hardcoded password set to "b", making it trivial to hijack. This built-in user isn't an admin and has no assigned roles. However, the researchers could still use it to authenticate via an alternate login path (/sitecore/admin) due to Sitecore's backend-only login checks being bypassed in non-core database contexts. The result is a valid ".AspNet.Cookies" session, granting the attacker authenticated access to internal endpoints protected by IIS-level authorization but not Sitecore role checks. With this initial foothold secured, attackers can exploit the second vulnerability, a Zip Slip flaw in Sitecore's Upload Wizard. As watchTowr explains, a ZIP file uploaded via the wizard can contain a malicious file path like /\/../webshell.aspx. Due to insufficient path sanitization and the way Sitecore maps paths, this results in writing arbitrary files into the webroot, even without knowledge of the full system path. This enables the attacker to upload a webshell and execute remote code. A third vulnerabili...
Sitecore CMS exploit chain starts with hardcoded 'b' password
BleepingComputer
·Bill Toulas
·Published Jun 17, 2025
·Updated
Affected Software
1 affected component
Sitecore Experience Platform
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a series of vulnerabilities in the Sitecore CMS that enable remote code execution.
2
What security implications are discussed in the article?
The vulnerabilities could allow attackers to breach and hijack servers without authentication.
3
What product is specifically affected by the vulnerabilities mentioned?
The affected product is the Sitecore Experience Platform.
4
How can attackers exploit the Sitecore CMS vulnerabilities?
Attackers can exploit the vulnerabilities using a hardcoded 'b' password to gain unauthorized access.
5
What type of execution can be achieved through the exploit chain?
The exploit chain allows attackers to perform remote code execution (RCE).