CVE-2019-10068

Deeper analysis

CVE-2019-10068 is a deserialization vulnerability affecting the staging service in Kentico CMS versions 12.0.x prior to 12.0.15, 11.0.x prior to 11.0.48, 10.0.x prior to 10.0.52, and all 9.x releases. The root cause is insufficient validation of security headers, which permits a crafted request to bypass authentication and supply attacker-controlled .NET objects for deserialization, directly enabling remote code execution on the host server. The flaw is tracked under CWE-502 and carries a CVSS 3.1 base score of 9.8.

An unauthenticated attacker with network access can submit a malicious request to the staging endpoint, trigger unsafe deserialization, and obtain arbitrary code execution with the privileges of the Kentico process. No user interaction or credentials are required, and the attack can result in full compromise of confidentiality, integrity, and availability on the affected server.

Kentico released hotfixes that address the issue for the supported branches, available via the vendor’s security updates page. The vulnerability is also catalogued in CISA’s Known Exploited Vulnerabilities list, and public exploit code has been published demonstrating remote command execution against unpatched instances.