CVE-2019-10068

What is Kentico Xperience?

Kentico Xperience is a commercial .NET-based content management and digital experience platform used by mid-size and enterprise organizations to run public-facing websites, intranets, and marketing portals. Like other .NET CMS platforms, it exposes a web-facing administration and content-delivery surface that, if it accepts and deserializes attacker-controlled data without adequate validation, can turn an ordinary HTTP request into full remote code execution on the underlying server.

Overview

CVE-2019-10068 is a Critical (9.8) deserialization of untrusted data vulnerability (CWE-502) in Kentico Xperience. The application fails to adequately validate certain security-related headers/tokens before deserializing data supplied in a request, allowing an unauthenticated remote attacker to craft a malicious serialized payload that, once deserialized by the vulnerable .NET code, executes arbitrary commands on the server. The vendor released a fix in March 2019.

Technical Details

Deserialization vulnerabilities occur when an application reconstructs objects from untrusted, attacker-supplied data without verifying that the data represents a safe, expected object graph. In .NET applications, this frequently allows attackers to instantiate "gadget" object chains that execute arbitrary code as a side effect of deserialization — a well-known and highly reliable class of RCE across many .NET and Java applications from this era. Here, the flaw requires no authentication and no user interaction, making it exploitable via a single crafted network request, which explains its Critical CVSS rating.

Discovery

Addressed by Kentico through its standard vendor security-fix process; no independent researcher has been broadly publicized as the original reporter.

Exploitation Context

CISA's KEV catalog confirms real-world exploitation of this flaw. Unauthenticated deserialization RCE bugs in web-facing CMS platforms are consistently attractive to opportunistic attackers running internet-wide scans, since a single successful request yields full server compromise without needing valid credentials — making unpatched, internet-exposed Kentico installations a persistent target for automated exploitation.

Remediation

1. Apply the vendor-supplied security patch for Kentico Xperience immediately.
2. Restrict direct internet exposure of Kentico administration interfaces where feasible, placing them behind authenticated access.
3. Review web server and application logs for anomalous POST requests containing serialized payloads predating patching.
4. Deploy a web application firewall with rules tuned to detect known .NET deserialization exploit patterns.
5. Rotate credentials and audit for webshells or unauthorized changes on any instance that was unpatched and internet-facing during the exposure window.