Detect Ajax.NET Professional Insecure Deserialization (CVE-2021-23758) in Splunk
Detects exploitation and exposure of CVE-2021-23758, a CWE-502 deserialization of untrusted data vulnerability in Ajax.NET Professional (AjaxPro). The AjaxPro framework converts JSON/type-hinted payloads posted to its endpoints (typically /ajaxpro/*.ashx) into .NET objects. When a request supplies attacker-controlled type information, the deserializer can be coerced into instantiating dangerous types (e.g. via the __type hint), enabling remote code execution on the IIS/ASP.NET worker process. This CVE is listed in the CISA KEV catalog. This detection surfaces suspicious POSTs to AjaxPro handlers containing type-manipulation markers, subsequent child-process spawns from w3wp.exe, and anomalous outbound activity indicative of successful gadget-chain execution.
MITRE ATT&CK
- Tactic
- Initial Access Execution
SPL Detection Query
index=iis (sourcetype=iis OR sourcetype="ms:iis:auto") cs_method=POST (cs_uri_stem="*ajaxpro*" OR cs_uri_stem="*.ashx")
| eval susType=if(match(cs_uri_query."__type",".+") OR searchmatch("*__type* OR *ObjectDataProvider* OR *WindowsIdentity*"),1,0)
| join type=left host [
search index=edr sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\net.exe" OR Image="*\\whoami.exe")
| rename Computer as host
| stats values(Image) as child_process values(CommandLine) as child_cmd by host
]
| table _time, c_ip, host, cs_uri_stem, cs_method, sc_status, child_process, child_cmd
| sort - _timeFinds POSTs to AjaxPro handlers correlated with w3wp.exe spawning command interpreters, a signature of successful AjaxPro deserialization RCE.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate AjaxPro method invocations from the application's own JavaScript client
- Vulnerability scanners exercising .ashx endpoints in authorized tests
- Application pools that legitimately shell out for scheduled maintenance tasks
Other platforms for CVE-2021-23758
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate AjaxPro type-manipulation POST
Expected signal: IIS W3C log entry: POST to /ajaxpro/*.ashx with body containing __type/ObjectDataProvider markers.
- Test 2Simulate w3wp.exe spawning command interpreter
Expected signal: Process creation event with parent w3wp.exe (or emulated) and child cmd.exe/whoami.exe.
- Test 3Simulate AjaxPro reconnaissance scan
Expected signal: Multiple GET requests to /ajaxpro/*.ashx paths from a single source IP in IIS logs.
References (4)
- https://nvd.nist.gov/vuln/detail/CVE-2021-23758
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Confirm the target host runs an ASP.NET/IIS application that references the AjaxPro (Ajax.NET Professional) framework and exposes /ajaxpro/*.ashx handlers.
- Pull the raw request body of the flagged POST and inspect for type-manipulation markers (__type, $type, ObjectDataProvider, WindowsIdentity, TypeConverter) that indicate an attempted gadget chain.
- Correlate the source IP against threat intel and review whether the same IP issued reconnaissance requests (GET to /ajaxpro/ or probing of .ashx endpoints) prior to the POST.
- Determine whether w3wp.exe spawned any child processes within a few minutes of the request and review their command lines.
Containment
- Block the offending source IP(s) at the WAF/perimeter and add a WAF rule denying POST bodies containing __type/type-hint markers to .ashx handlers.
- Isolate the affected IIS host from the network if child-process execution from w3wp.exe is confirmed, to prevent lateral movement.
- Recycle or stop the affected IIS application pool to terminate any in-memory attacker foothold pending remediation.
Evidence Collection
- Preserve IIS W3C logs, HTTP request bodies, and any WAF logs covering the exploitation window.
- Capture the w3wp.exe process tree, loaded modules, and command lines of spawned child processes via EDR.
- Collect a memory image of the IIS worker process and copies of any files written to the web root or temp directories during the incident.
Escalation Criteria
- !Escalate to incident response immediately if w3wp.exe is confirmed to have spawned a command interpreter, dropped files, or made outbound connections.
- !Escalate to the application owner and initiate patching if the host is confirmed to run a vulnerable AjaxPro version, even absent successful exploitation.
- !Escalate to threat hunting if the same exploitation pattern is observed across multiple internet-facing IIS hosts.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS W3C log entries showing POSTs to /ajaxpro/*.ashx with anomalous body length or type markers - >
w3wp.exe child-process creation events (Sysmon EventCode 1 / EDR ProcessRollup) with unusual command lines - >
Newly created .aspx/.ashx files or temporary compiled assemblies in the web root and ASP.NET temp folders - >
Outbound network connections originating from the IIS worker process
Tuning Guidance
Baseline the legitimate AjaxPro method endpoints and typical request body sizes for your application, then alert on requests carrying type-hint markers or abnormally large bodies. Suppress known scanner IPs and authorized test ranges. Tighten severity to critical only when the web request is correlated with a w3wp.exe child-process spawn; use the web-only signal as a lower-severity exposure/attempt indicator.
Hunting Queries
Surfaces source IPs making repeated POSTs to AjaxPro handlers, useful for spotting automated exploitation or brute-forcing of gadget chains.
W3CIISLog | where csMethod == "POST" and csUriStem has "ajaxpro" | summarize count(), avg(csBytes) by cIP, sComputerName | where count_ > 5index=iis cs_method=POST cs_uri_stem="*ajaxpro*" | stats count avg(sc_bytes) as avg_bytes by c_ip, host | where count > 5Atomic Red Team Tests
Sends a POST to a lab AjaxPro .ashx handler containing a __type gadget marker to exercise the deserialization detection path.
Command
powershell -Command "Invoke-WebRequest -Uri 'http://localhost/ajaxpro/AjaxPro.Services,App.ashx' -Method POST -Headers @{'X-AjaxPro-Method'='Test'} -Body '{\"__type\":\"System.Windows.Data.ObjectDataProvider\",\"payload\":\"whoami\"}'"Cleanup
Remove-Item -Path "$env:TEMP\ajaxpro_test.log" -ErrorAction SilentlyContinueExpected Telemetry
IIS W3C log entry: POST to /ajaxpro/*.ashx with body containing __type/ObjectDataProvider markers.
Expected Detection
KQL/SPL AjaxPro POST detection fires on the type-manipulation marker in the request.
Launches cmd.exe with a parent chain emulating the IIS worker to validate the post-exploitation process-spawn detection.
Command
cmd.exe /c "whoami & hostname"Cleanup
echo No cleanup required; benign informational commands only.Expected Telemetry
Process creation event with parent w3wp.exe (or emulated) and child cmd.exe/whoami.exe.
Expected Detection
CrowdStrike/Sysmon correlation detects w3wp.exe child command interpreter.
Issues GET probes enumerating common AjaxPro handler paths to exercise the reconnaissance hunting query.
Command
for p in ajaxpro/AjaxPro.Services.ashx ajaxpro/core.ashx ajaxpro/prototype.ashx; do curl -s -o /dev/null -w '%{http_code}\n' http://localhost/$p; doneCleanup
echo No cleanup required; read-only GET requests.Expected Telemetry
Multiple GET requests to /ajaxpro/*.ashx paths from a single source IP in IIS logs.
Expected Detection
Reconnaissance hunting query flags repeated AjaxPro endpoint probing from one IP.