CVE-2025-14611 Elastic Security · Elastic

Detect Gladinet CentreStack and Triofox Hard-Coded Cryptographic Key Exploitation in Elastic Security

Detects exploitation of CVE-2025-14611, a hard-coded cryptographic key vulnerability (CWE-798) in Gladinet CentreStack and Triofox. Attackers who obtain the static machineKey or cryptographic seed can forge ASP.NET ViewState tokens or authentication artifacts, enabling remote code execution via deserialization attacks without valid credentials. This vulnerability is actively exploited and listed on CISA KEV.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=2m
  [network where event.dataset == "iis.access" and
   http.request.method == "POST" and
   url.path : ("*/portal/*", "*/triofox/*", "*/centrestack/*", "*/fileserver/*") and
   (
     length(url.query) > 500 or
     http.response.status_code == 500
   )
  ] by host.name
  [process where event.type == "start" and
   process.parent.name : ("w3wp.exe", "IIS Worker Process") and
   process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
  ] by host.name
critical severity high confidence

EQL sequence rule that correlates anomalous POST requests to Gladinet web endpoints (with oversized query strings or 500 errors) followed within 2 minutes by suspicious child process creation from IIS worker processes, indicating successful ViewState deserialization RCE via CVE-2025-14611.

Data Sources

IIS Access LogsWindows Process EventsElastic Endpoint

Required Tables

logs-iis.access-*logs-endpoint.events.process-*

False Positives & Tuning

  • Legitimate IIS application errors followed by administrative PowerShell sessions on the same host
  • Automated deployment scripts spawning cmd.exe from w3wp.exe during application updates
  • IIS management tools that legitimately spawn child processes from the worker process
  • Penetration tests conducted against the CentreStack environment

Other platforms for CVE-2025-14611

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Forged ASP.NET ViewState Payload Submission to CentreStack Endpoint

    Expected signal: IIS access log entry showing POST to /portal/default.aspx with large cs-uri-query value; HTTP response code 500 if payload is malformed, 200 if bypassed; network events capturing the inbound connection

  2. Test 2IIS Worker Process Child Shell Spawn Simulation (Lab)

    Expected signal: Windows Security Event ID 4688 for cmd.exe process creation; EDR process telemetry showing PowerShell spawning cmd.exe; file creation event for exploit_sim_output.txt in C:\Temp

  3. Test 3CentreStack web.config Hard-Coded MachineKey Inspection

    Expected signal: File read event on web.config via Sysmon Event ID 11/4663; PowerShell script block logging capturing the content search pattern; output file creation at C:\Temp\machinekey_audit.txt

  4. Test 4Forged Authentication Token Submission via Hardcoded Key (Lab Only)

    Expected signal: IIS access log showing GET request with .ASPXAUTH cookie header; Windows authentication event logs (Event ID 4624/4625) recording the authentication attempt; network events capturing the connection from the test host

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the targeted host is running Gladinet CentreStack or Triofox by checking installed software, IIS site bindings, and web.config files for Gladinet-specific application keys and paths.
  2. Review IIS access logs for POST requests to portal, fileserver, or API paths containing abnormally large __VIEWSTATE parameters (base64-encoded payloads exceeding 500 bytes); cross-reference source IPs against threat intel feeds.
  3. Check Windows Security Event logs (Event ID 4688) for any process creation events where w3wp.exe is the parent and the child is cmd.exe, powershell.exe, wscript.exe, or other scripting interpreters, noting the exact command lines executed.
  4. Determine whether the affected CentreStack or Triofox installation uses the default hard-coded machineKey or has been hardened per vendor guidance at the referenced support article; presence of a static machineKey in web.config confirms exploitability.

Containment

  1. Immediately rotate the machineKey and validationKey values in the CentreStack or Triofox web.config following vendor hardening guidance, then recycle the IIS application pool to invalidate all existing forged tokens.
  2. Block inbound access to CentreStack/Triofox from all external IPs via firewall or WAF rule while patching; if the service must remain available, implement strict IP allowlisting and add WAF rules to reject requests with oversized ViewState payloads.
  3. If active exploitation is confirmed (shell spawned from w3wp.exe), isolate the host from the network immediately and capture a full memory image before terminating suspicious processes to preserve forensic evidence.

Evidence Collection

  1. Collect IIS access logs (W3C format) from the CentreStack/Triofox server covering the suspected exploitation window; specifically extract POST requests with encoded __VIEWSTATE values and record all originating IP addresses and user-agent strings.
  2. Capture a Windows process snapshot and active network connections using `tasklist /v`, `netstat -anob`, and EDR telemetry to identify any persistent mechanisms (scheduled tasks, registry run keys, services) installed by the attacker via the deserialization payload.
  3. Export the CentreStack web.config file and record the current machineKey/validationKey values to confirm whether the default hard-coded key was in use at time of exploitation; retain this as evidence of the vulnerability state.

Escalation Criteria

  • !Escalate to incident response if any evidence of lateral movement is found (e.g., pass-the-hash activity, new local admin accounts created, or RDP connections originating from the compromised CentreStack host).
  • !Escalate immediately if the CentreStack server has access to sensitive internal resources (Active Directory, file shares, databases) and attacker-controlled processes were observed communicating with those resources or dumping credentials.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS access logs at `%SystemDrive%\inetpub\logs\LogFiles\` containing POST requests to Gladinet paths with oversized base64-encoded query parameters
  • >Windows Application Event Log entries (Event ID 1000/1001) for w3wp.exe application crashes, which may precede successful exploitation attempts during payload refinement
  • >Prefetch files and Shimcache entries for cmd.exe, powershell.exe, or other binaries with a parent path referencing w3wp.exe, confirming shell spawning
  • >CentreStack web.config at the IIS site root containing machineKey/validationKey attributes — static values indicate vulnerability; presence of default Gladinet keys confirms exploitation risk

Tuning Guidance

Reduce false positives by scoping detections to hosts confirmed to be running Gladinet CentreStack or Triofox (maintain an asset inventory tag). Raise the ViewState payload size threshold from 500 to 800 characters if legitimate application operations generate false alerts. The w3wp.exe child process spawn rule is high-fidelity; threshold tuning is not recommended for that component. If the environment uses custom application pools under non-standard identities, update parent process filters accordingly. Consider adding ASN or geolocation filtering if CentreStack is only accessed from specific regions.

Hunting Queries

Retrospective 7-day hunt for any instance of IIS worker process (w3wp.exe) spawning command interpreters or scripting engines, which is the primary post-exploitation indicator for CVE-2025-14611 deserialization RCE on Gladinet CentreStack/Triofox hosts.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where ParentProcessName has 'w3wp'
| where NewProcessName has_any ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe')
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog EventCode=4688 ParentProcessName="*w3wp.exe*"
| where process_name IN ("*cmd.exe*", "*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*mshta.exe*")
| table _time, host, user, ParentProcessName, process_name, CommandLine
| sort -_time

Hunt for historically anomalous POST requests with large query strings to Gladinet endpoints over the past 7 days, identifying reconnaissance or exploitation attempts involving forged ViewState payloads leveraging the hard-coded machineKey.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ('/portal', '/triofox', '/centrestack', '/fileserver')
| where csMethod =~ 'POST'
| extend QueryLength = strlen(csUriQuery)
| where QueryLength > 400
| summarize count(), avg(QueryLength), max(QueryLength), make_set(cIP) by csUriStem, bin(TimeGenerated, 1h)
| order by max_QueryLength desc
Hunting — SPL
spl 
index=iis cs_method=POST (cs_uri_stem="*/portal/*" OR cs_uri_stem="*/triofox/*" OR cs_uri_stem="*/centrestack/*" OR cs_uri_stem="*/fileserver/*") earliest=-7d
| eval query_len=len(cs_uri_query)
| where query_len > 400
| stats count, avg(query_len) as avg_len, max(query_len) as max_len, values(c_ip) as sources by cs_uri_stem, date_hour
| sort -max_len

Atomic Red Team Tests

Test 1 Simulate Forged ASP.NET ViewState Payload Submission to CentreStack Endpoint
linux

Sends a crafted POST request to a lab CentreStack instance containing a large base64-encoded string in the __VIEWSTATE parameter, simulating what an attacker would send when exploiting the hard-coded machineKey to deliver a deserialization payload.

Command

bash 
curl -s -k -X POST 'http://TARGET_CENTRESTACK_HOST/portal/default.aspx' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' --data '__VIEWSTATE=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==&__EVENTVALIDATION=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB==&__EVENTTARGET=&__EVENTARGUMENT=' -v 2>&1 | tee /tmp/gladinet_viewstate_test.txt

Cleanup

bash 
rm -f /tmp/gladinet_viewstate_test.txt

Expected Telemetry

IIS access log entry showing POST to /portal/default.aspx with large cs-uri-query value; HTTP response code 500 if payload is malformed, 200 if bypassed; network events capturing the inbound connection

Expected Detection

kql and spl queries should fire on the oversized POST parameter to the portal path; no process spawn expected from this benign payload simulation

Test 2 IIS Worker Process Child Shell Spawn Simulation (Lab)
windows

Simulates the post-exploitation behavior of a successful deserialization attack by directly spawning cmd.exe under the context of an IIS application pool on a Windows lab system, mimicking what the deserialized payload would execute after CVE-2025-14611 exploitation.

Command

powershell 
# Run in lab environment only — requires local admin
# Simulates w3wp.exe spawning cmd.exe (actual exploit would originate from deserialization)
powershell.exe -Command "Start-Process -FilePath 'cmd.exe' -ArgumentList '/c whoami > C:\\Temp\\exploit_sim_output.txt & hostname >> C:\\Temp\\exploit_sim_output.txt & ipconfig >> C:\\Temp\\exploit_sim_output.txt' -NoNewWindow -Wait"

Cleanup

powershell 
del C:\Temp\exploit_sim_output.txt

Expected Telemetry

Windows Security Event ID 4688 for cmd.exe process creation; EDR process telemetry showing PowerShell spawning cmd.exe; file creation event for exploit_sim_output.txt in C:\Temp

Expected Detection

Process creation rules in kql (SecurityEvent EventID 4688) and crowdstrike_cql should flag cmd.exe spawning; Chronicle YARA-L process chain rule should generate an alert if correlated with a preceding web request

Test 3 CentreStack web.config Hard-Coded MachineKey Inspection
windows

Inspects the CentreStack or Triofox web.config for the presence of a static or default machineKey value, confirming vulnerability to CVE-2025-14611. In a real attack scenario, an attacker who gains read access to this file can extract the key to forge tokens.

Command

powershell 
# Lab only — run on system with CentreStack installed
# Replace path with actual CentreStack installation directory
powershell.exe -Command "$webconfig = Get-Content 'C:\\Program Files (x86)\\Gladinet\\CentreStack\\web.config' -Raw; if ($webconfig -match 'machineKey\s+validationKey=\"([^\"]+)\"') { Write-Host 'VULNERABLE: Static machineKey found:'; Write-Host $Matches[1] } else { Write-Host 'machineKey not found in default location' }" > C:\Temp\machinekey_audit.txt 2>&1

Cleanup

powershell 
del C:\Temp\machinekey_audit.txt

Expected Telemetry

File read event on web.config via Sysmon Event ID 11/4663; PowerShell script block logging capturing the content search pattern; output file creation at C:\Temp\machinekey_audit.txt

Expected Detection

File access telemetry for web.config should be visible in EDR; this test validates the vulnerability state rather than triggering network-based detections — use result to confirm whether SIEM rules targeting exploitation need to be activated immediately

Test 4 Forged Authentication Token Submission via Hardcoded Key (Lab Only)
linux

Using a known default Gladinet machineKey value, generates a forged ASP.NET authentication cookie and submits it to a lab CentreStack instance to test whether the application accepts it without valid credentials, confirming exploitability of CVE-2025-14611.

Command

bash 
# Lab environment only — requires Python3 and a test CentreStack instance
# Install dependency: pip3 install pydes pycryptodome
# This uses a synthetic/test key — replace with the actual static key found in web.config for real assessment
python3 -c "
import base64, hmac, hashlib
# Synthetic test key (not a real production key)
test_validation_key = 'AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899'
test_payload = b'ForgedAuthToken:TestUser:Administrator'
sig = hmac.new(bytes.fromhex(test_validation_key), test_payload, hashlib.sha1).digest()
token = base64.b64encode(test_payload + sig).decode()
print(f'Forged token: {token}')
" > /tmp/forged_token.txt
curl -s -k -X GET 'http://TARGET_HOST/portal/' -H "Cookie: .ASPXAUTH=$(cat /tmp/forged_token.txt)" -v 2>&1 | grep -E '(HTTP/|Location:|Set-Cookie:)' | tee /tmp/token_test_result.txt

Cleanup

bash 
rm -f /tmp/forged_token.txt /tmp/token_test_result.txt

Expected Telemetry

IIS access log showing GET request with .ASPXAUTH cookie header; Windows authentication event logs (Event ID 4624/4625) recording the authentication attempt; network events capturing the connection from the test host

Expected Detection

Authentication anomaly rules may fire on the forged cookie submission; if the server returns HTTP 302 redirect to authenticated content rather than 401/403, exploitation is confirmed; SIEM rules should capture the anomalous authentication event

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.001PowerShellT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections