Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution

"CVE-2025-53693 - HTML cache poisoning through unsafe reflections CVE-2025-53691 - Remote code execution (RCE) through insecure deserialization CVE-2025-53694 - Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach Patches for the first two shortcomings were released by Sitecore in June and for the third in July 2025, with the company stating that "successful exploitation of the related vulnerabilities might lead to remote code execution and non-authorized access to information.""

"The findings build on three more flaws in the same product that were detailed by watchTowr back in June - CVE-2025-34509 (CVSS score: 8.2) - Use of hard-coded credentials CVE-2025-34510 (CVSS score: 8.8) - Post-authenticated remote code execution via path traversal CVE-2025-34511 (CVSS score: 8.8) - Post-authenticated remote code execution via Sitecore PowerShell Extension watchTowr Labs researcher Piotr Bazydlo said the newly uncovered bugs could be fashioned into an exploit chain"

"The entire sequence of events leading up to code execution is as follows: A threat actor could leverage the ItemService API, if exposed, to trivially enumerate HTML cache keys stored in the Sitecore cache and send HTTP cache poisoning requests to those keys. This could then be chained with CVE-2025-53691 to supply malicious HTML code that ultimately results in code execution by means of an unrestricted BinaryFormatter call."

Three new Sitecore Experience Platform vulnerabilities enable HTML cache poisoning (CVE-2025-53693), insecure-deserialization remote code execution (CVE-2025-53691), and ItemService API information disclosure exposing cache keys (CVE-2025-53694). Patches for the first two were released in June and for the third in July 2025. Successful exploitation can lead to remote code execution and unauthorized information access. An exploit chain is feasible by enumerating HTML cache keys via the ItemService API, sending HTTP cache-poisoning requests to those keys, and chaining with the insecure deserialization flaw to deliver malicious HTML that triggers code execution via an unrestricted BinaryFormatter call. Prior related flaws include hard-coded credentials and post-auth RCE issues.

Read at The Hacker News