Detect Kentico Xperience CMS Authentication Bypass (CVE-2025-2747) in Microsoft Sentinel
Detects exploitation of CVE-2025-2747, an authentication bypass vulnerability (CWE-288) in Kentico Xperience CMS. Attackers can access protected administrative or content management endpoints via alternate paths or channels without valid credentials, enabling unauthorized access to sensitive CMS functionality. This vulnerability is actively exploited in the wild and listed in CISA KEV.
MITRE ATT&CK
KQL Detection Query
union isfuzzy=true
(
W3CIISLog
| where csUriStem has_any ("/CMSPages/", "/CMSModules/", "/Admin/", "/KenticoCMS/", "/cms/", "/CMS/", "/cmspages/")
| where csUriStem has_any ("GetResource", "CMSFormControls", "GetDoc", "CMSDesk", "sitemanager", "SiteManager")
| where scStatus in (200, 201, 302) and csUsername in ("", "-", "anonymous")
| project TimeGenerated, Computer, csClientIP=c_ip, csMethod=cs_method, csUriStem=cs_uri_stem, csUriQuery=cs_uri_query, scStatus=sc_status, scBytes=sc_bytes, csUsername=cs_username, csUserAgent=cs_user_agent
),
(
AzureDiagnostics
| where Category == "ApplicationGatewayAccessLog"
| where requestUri_s has_any ("/CMSPages/", "/CMSModules/", "/Admin/", "/KenticoCMS/")
| where httpStatus_d in (200, 201, 302)
| project TimeGenerated, clientIP_s, requestUri_s, httpStatus_d, userAgent_s, host_s
)
| where TimeGenerated >= ago(1d)Detects unauthenticated or anonymously-authenticated HTTP requests to sensitive Kentico Xperience CMS administrative and module paths that return successful HTTP responses, which may indicate authentication bypass exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate public-facing CMS pages under /CMSPages/ that are intentionally unauthenticated
- Health check or monitoring probes accessing CMS resource endpoints
- CDN or reverse proxy pre-fetching static assets served through CMS module paths
- Automated site crawlers or SEO tools accessing publicly exposed CMS paths
Other platforms for CVE-2025-2747
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Kentico CMS Unauthenticated Admin Path Access Simulation
Expected signal: IIS access logs will record HTTP GET requests to each tested path with the source IP of the test host; requests will appear with no authenticated username (cs_username = '-').
- Test 2Alternate Channel Authentication Bypass via Parameter Manipulation
Expected signal: Web server logs capture each variant request with full URI including query string; WAF logs may flag path traversal patterns in the query string.
- Test 3Post-Bypass Webshell Upload Simulation via CMS File Manager
Expected signal: Windows Security Event Log will show file creation event (Event ID 4663) for test_detection.aspx under the CMS web root; Sysmon Event ID 11 (FileCreate) will capture the new .aspx file creation with the IIS worker process (w3wp.exe) as the creator.
Unlock Pro Content
Get the full detection package for CVE-2025-2747 including response playbook, investigation guide, and atomic red team tests.