CVE-2021-23758

What is Ajax.NET Professional?

Ajax.NET Professional (AjaxPro) is an open-source AJAX framework for ASP.NET applications. It lets client-side JavaScript invoke server-side .NET methods by serialising call arguments and return values as JSON over HTTP. To do that, AjaxPro registers an HTTP handler that receives request bodies and deserialises them into .NET objects — a design that puts an untrusted-input deserialiser directly on the network-facing request path. Although the framework is old, it remains embedded in many legacy ASP.NET line-of-business and intranet applications.

Overview

CVE-2021-23758 is an insecure-deserialization vulnerability (CWE-502) in AjaxPro. The framework deserialises attacker-controlled JSON into arbitrary .NET types without adequately restricting which types may be instantiated. By supplying a crafted request that references a dangerous "gadget" type, a remote, unauthenticated attacker can trigger object instantiation and method invocation that leads to arbitrary code execution on the server hosting the application.

Affected Versions

AjaxPro is effectively end-of-life; many deployments embed a bundled AjaxPro.dll in the application rather than tracking a package version. Applications that ship an unpatched DLL remain vulnerable regardless of the host framework version.

Technical Details

The flaw is a classic .NET unsafe-deserialization gadget-chain issue. AjaxPro's JSON deserialiser honours type information embedded in the request and constructs the specified .NET types, allowing an attacker to reach known gadget types whose construction or property-setting has dangerous side effects (process execution, file writes, etc.). No authentication is required (PR:N) because the AjaxPro handler is reachable by any client that can send HTTP requests to it. The High attack complexity (AC:H) reflects that a working exploit depends on a suitable gadget being present in the target's loaded assemblies and on request-encoding specifics. The fix restricts deserialization to an allowlist of expected types rather than honouring arbitrary attacker-specified types.

Discovery

The vulnerability was reported by the Snyk Security Research team and published on 3 December 2021. The AjaxPro maintainer (Michael Schwarz) addressed it by tightening the deserialiser to reject unexpected types.

Exploitation Context

Insecure .NET deserialization flaws are a favoured route to server-side RCE, and public tooling (e.g. gadget-chain generators) makes weaponisation straightforward once a vulnerable endpoint is identified. CISA's August 2026 KEV addition indicates confirmed exploitation in the wild against internet-exposed legacy ASP.NET applications that still ship the vulnerable AjaxPro handler. Because the handler is often mounted at a predictable path, attackers can fingerprint and target it at scale.

Remediation

1. Update AjaxPro to a build that includes the December 2021 type-restriction fix (commit b0e63be…), replacing the bundled AjaxPro.dll in affected applications.
2. Remove AjaxPro entirely where feasible — it is an unmaintained legacy framework, and migrating the affected endpoints to a modern, supported AJAX/API mechanism eliminates the deserialization surface.
3. Block or restrict access to the AjaxPro handler path at the reverse proxy / WAF if immediate patching is not possible, limiting it to trusted networks.
4. Do not expose legacy ASP.NET applications directly to the internet; place them behind authentication and network controls.
5. Review IIS and application logs for requests to the AjaxPro handler with unusual payloads, and hunt for signs of code execution (unexpected child processes of the worker process, new files in web directories).