Sitecore 8.x - Deserialization Remote Code Execution

Author: Jarad Kopf
type: webapps
platform: aspx
port: 
date_added: 2019-06-13 
date_updated: 2019-06-13 
verified: 0 
codes: CVE-2019-11080 
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Sitecore v 8.x Deserialization RCE
# Date: Reported to vendor October 2018, fix released April 2019.
# Exploit Author: Jarad Kopf
# Vendor Homepage: https://www.sitecore.com/
# Software Link: Sitecore downloads: https://dev.sitecore.net/Downloads.aspx
# Version: Sitecore 8.0 Revision 150802
# Tested on: Windows
# CVE : CVE-2019-11080

Exploit:

Authentication is needed for this exploit. An attacker needs to login to Sitecore 8.0 revision 150802's Admin section.
When choosing to Serializeusers or domains in the admin UI, calls to /sitecore/shell/~/xaml/Sitecore.Shell.Applications.Dialogs.Progress.aspx will include a CSRFTOKEN parameter.
By replacing this parameter with a URL-encoded, base64-encoded crafted payload from ysoserial.net, an RCE is successful.