Detect Kentico Xperience CMS Authentication Bypass (CVE-2025-2747) in Elastic Security
Detects exploitation of CVE-2025-2747, an authentication bypass vulnerability (CWE-288) in Kentico Xperience CMS. Attackers can access protected administrative or content management endpoints via alternate paths or channels without valid credentials, enabling unauthorized access to sensitive CMS functionality. This vulnerability is actively exploited in the wild and listed in CISA KEV.
MITRE ATT&CK
Elastic Detection Query
sequence by source.ip with maxspan=5m
[network where event.dataset == "iis.access" and
url.path : ("/CMSPages/*", "/CMSModules/*", "/Admin/*", "/KenticoCMS/*", "/CMS/SiteManager/*", "/CMS/CMSDesk/*") and
http.response.status_code in (200, 201, 302) and
(user.name == "-" or user.name == "" or user.name == "anonymous" or user.name == null)]
[network where event.dataset == "iis.access" and
url.path : ("/CMSPages/*", "/CMSModules/*", "/Admin/*") and
http.response.status_code in (200, 201, 302)]Uses EQL sequence to detect repeated unauthenticated access to multiple Kentico CMS administrative paths from the same IP within 5 minutes, indicating active exploitation or post-bypass enumeration.
Data Sources
Required Tables
False Positives & Tuning
- Public-facing Kentico CMS pages accessible without authentication by design
- Automated testing pipelines running integration tests against CMS endpoints
- Security scanners performing legitimate authenticated vulnerability assessments
- Shared application user accounts logged as anonymous in specific middleware configurations
Other platforms for CVE-2025-2747
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Kentico CMS Unauthenticated Admin Path Access Simulation
Expected signal: IIS access logs will record HTTP GET requests to each tested path with the source IP of the test host; requests will appear with no authenticated username (cs_username = '-').
- Test 2Alternate Channel Authentication Bypass via Parameter Manipulation
Expected signal: Web server logs capture each variant request with full URI including query string; WAF logs may flag path traversal patterns in the query string.
- Test 3Post-Bypass Webshell Upload Simulation via CMS File Manager
Expected signal: Windows Security Event Log will show file creation event (Event ID 4663) for test_detection.aspx under the CMS web root; Sysmon Event ID 11 (FileCreate) will capture the new .aspx file creation with the IIS worker process (w3wp.exe) as the creator.
Response Playbook
Triage
- Identify the source IP of the suspicious request and cross-reference with threat intelligence feeds for known malicious actors, Tor exit nodes, or VPN/proxy infrastructure.
- Review the full HTTP request including URI path, query string, headers, and body to determine which Kentico CMS protected endpoint was accessed and whether admin-level functionality was reached.
- Determine the Kentico Xperience CMS version deployed by checking the application server or package manifests, and confirm whether the installed version is in the affected range requiring hotfix application.
- Check IIS or web server logs for the 10 minutes preceding the alert to identify reconnaissance patterns such as path enumeration, 401/403 responses followed by the bypass attempt, or unusual user-agent strings.
Containment
- Immediately block the source IP at the perimeter firewall or WAF and preserve the block rule with a time-bounded review period to avoid permanent false-positive blocks.
- If exploitation is confirmed, take the Kentico CMS application offline or enable maintenance mode to prevent further unauthorized access while the hotfix from https://devnet.kentico.com/download/hotfixes is applied.
- Rotate all CMS administrator credentials and any API keys or secrets accessible via the CMS administration panel, as the attacker may have exfiltrated or modified credentials during the bypass window.
Evidence Collection
- Preserve full IIS or web server access logs for the affected host covering at least 72 hours prior to detection, ensuring log integrity via hash verification before any remediation actions.
- Capture a memory dump and disk image of the CMS application server if active intrusion is suspected, to preserve evidence of any webshells, modified files, or injected processes prior to patching.
Escalation Criteria
- !Escalate to incident response if any CMS administrator account shows login activity during or after the period of the bypass attempt, indicating credential theft or persistence establishment.
- !Escalate immediately if evidence of webshell upload, file modification under the CMS web root, or lateral movement from the CMS server to internal network hosts is discovered during triage.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS W3C log entries showing HTTP 200/302 responses to /CMSPages/, /CMSModules/, /Admin/, or /CMSDesk paths from unauthenticated sessions - >
Windows Event Log (Security) showing new file creation events under the Kentico web root directory, particularly .aspx, .ashx, or .asmx files created after the bypass window - >
CMS audit log (Kentico Event Log module) for admin-level actions performed without a corresponding authenticated session, accessible via the Kentico admin interface or directly from the CMS database
Tuning Guidance
Start by baselining which /CMSPages/ and /CMSModules/ paths in your environment are legitimately public-facing and add them to an allowlist to reduce false positives. The highest-fidelity signals are successful (HTTP 200) unauthenticated requests to /Admin/, /SiteManager/, and /CMSDesk paths — these should never be publicly accessible and can be tuned to high confidence. If your environment uses a WAF or reverse proxy that strips authentication headers before they reach IIS, adjust the query to use session cookie presence rather than cs_username field. Consider correlating the source IP across a longer time window to distinguish one-shot exploit attempts from scanning noise.
Hunting Queries
Retrospective 7-day hunt for source IPs that made multiple successful unauthenticated requests to Kentico CMS protected paths, to identify exploitation that predates the detection rule deployment.
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/CMSPages/", "/CMSModules/", "/Admin/", "/KenticoCMS/", "/CMSDesk", "/SiteManager")
| where scStatus in (200, 201, 302)
| summarize RequestCount=count(), UniquePaths=dcount(csUriStem), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by c_ip, cs_username
| where cs_username in ("", "-", "anonymous") and RequestCount > 3
| order by RequestCount descindex=web (sourcetype=iis OR sourcetype=access_combined) earliest=-7d
| where (like(uri_path, "%/CMSPages/%") OR like(uri_path, "%/CMSModules/%") OR like(uri_path, "%/Admin/%") OR like(uri_path, "%CMSDesk%") OR like(uri_path, "%SiteManager%"))
| where status IN ("200", "201", "302")
| where cs_username IN ("-", "", "anonymous") OR isnull(cs_username)
| stats count AS hits, dc(uri_path) AS unique_paths, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip
| where hits > 3
| sort -hitsAtomic Red Team Tests
Simulates an authentication bypass attempt by sending unauthenticated HTTP GET requests to common Kentico Xperience CMS administrative paths to test detection coverage.
Command
TARGET_HOST="http://kentico-cms-lab.internal"; for path in "/CMSPages/GetResource.ashx" "/CMS/CMSDesk/Default.aspx" "/CMS/SiteManager/Default.aspx" "/CMSModules/REST/CMSPages/REST.svc" "/Admin/"; do echo "[*] Testing: $path"; curl -sk -o /dev/null -w "Status: %{http_code} | URL: $TARGET_HOST$path\n" "$TARGET_HOST$path"; doneCleanup
No cleanup required; this test only sends read-only HTTP requests to the target lab host.Expected Telemetry
IIS access logs will record HTTP GET requests to each tested path with the source IP of the test host; requests will appear with no authenticated username (cs_username = '-').
Expected Detection
The KQL, SPL, and Sumo Logic detections should fire on any path that returns HTTP 200 or 302 with an anonymous user, particularly for /CMSDesk/ and /SiteManager/ paths.
Tests whether Kentico CMS improperly handles authentication checks when accessing resources via alternate query parameters or path segments that bypass the normal authentication middleware.
Command
TARGET_HOST="http://kentico-cms-lab.internal"; declare -a BYPASS_VARIANTS=("/CMSPages/GetDoc.aspx?NodeAliasPath=/" "/CMSPages/GetResource.ashx?fileName=/../Admin/" "/CMS/CMSDesk/Default.aspx;.js" "/CMSModules/REST/CMSPages/REST.svc/content/"); for variant in "${BYPASS_VARIANTS[@]}"; do echo "[*] Trying bypass variant: $variant"; curl -sk -o /dev/null -w "HTTP %{http_code} for: $variant\n" "$TARGET_HOST$variant"; doneCleanup
No cleanup required; read-only HTTP requests only.Expected Telemetry
Web server logs capture each variant request with full URI including query string; WAF logs may flag path traversal patterns in the query string.
Expected Detection
Detections covering URI path matching should trigger on variants returning HTTP 200/302; WAF rules may additionally fire on path traversal sequences in query parameters.
Simulates the most common post-exploitation action following a Kentico authentication bypass: uploading an ASPX webshell through the CMS file management interface using a session obtained without valid credentials.
Command
# Lab only — assumes authentication bypass has been demonstrated and a session cookie obtained
$SESSION_COOKIE = "CMSUserContext=BYPASSED_SESSION_TOKEN"
$TARGET = "http://kentico-cms-lab.internal"
$WEBSHELL_CONTENT = "<%@ Page Language='C#' %><% Response.Write(\"WEBSHELL_TEST_\"+DateTime.Now.ToString()); %>"
$BOUNDARY = "----WebKitFormBoundary7MA4YWxkTrZu0gW"
$BODY = "--$BOUNDARY`r`nContent-Disposition: form-data; name=`"file`"; filename=`"test_detection.aspx`"`r`nContent-Type: application/octet-stream`r`n`r`n$WEBSHELL_CONTENT`r`n--$BOUNDARY--"
Invoke-WebRequest -Uri "$TARGET/CMSModules/FileManager/FileManager.aspx" -Method POST -Headers @{Cookie=$SESSION_COOKIE; 'Content-Type'="multipart/form-data; boundary=$BOUNDARY"} -Body $BODY -UseBasicParsing | Select-Object -ExpandProperty StatusCodeCleanup
Remove test_detection.aspx from the Kentico web root: Remove-Item "C:\inetpub\wwwroot\CMS\test_detection.aspx" -ErrorAction SilentlyContinueExpected Telemetry
Windows Security Event Log will show file creation event (Event ID 4663) for test_detection.aspx under the CMS web root; Sysmon Event ID 11 (FileCreate) will capture the new .aspx file creation with the IIS worker process (w3wp.exe) as the creator.
Expected Detection
File integrity monitoring and endpoint detection rules for webshell creation should fire on the .aspx file creation by w3wp.exe; network detections will capture the multipart POST to the FileManager path.