CVE-2025-2749 Google Chronicle · YARA-L

Detect Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749) in Google Chronicle

Detects exploitation of CVE-2025-2749, a path traversal and unrestricted file upload vulnerability in Kentico Xperience CMS. Attackers can traverse directory boundaries to write arbitrary files — including web shells — to locations outside the intended upload path, enabling remote code execution on the hosting server. This CVE is listed in the CISA Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2025_2749_kentico_path_traversal {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects path traversal exploitation attempts against Kentico Xperience CMS (CVE-2025-2749)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2749"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /POST|PUT/
    (
      $e.network.http.target_url = /\/kentico\//i nocase or
      $e.network.http.target_url = /\/cmspages\//i nocase or
      $e.network.http.target_url = /\/cmsformcontrols\//i nocase or
      $e.network.http.target_url = /\/uploadfile\//i nocase
    )
    (
      $e.network.http.target_url = /\.\.\//i or
      $e.network.http.target_url = /%2e%2e/i or
      $e.network.http.target_url = /%252e/i or
      $e.network.http.target_url = /\.\.%2f/i or
      $e.network.http.target_url = /\.\.%5c/i
    )

  condition:
    $e
}
critical severity high confidence

Chronicle YARA-L rule detecting HTTP POST/PUT requests to Kentico Xperience CMS endpoints containing path traversal sequences that could exploit CVE-2025-2749.

Data Sources

Chronicle SIEM Web Proxy LogsChronicle Network HTTP Events

Required Tables

network_http

False Positives & Tuning

  • Authorized red team exercises targeting Kentico installations
  • URL-encoded characters in legitimate multilingual or special-character filenames
  • Third-party integrations using encoded path components in API calls to Kentico

Other platforms for CVE-2025-2749

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Kentico Path Traversal Upload Simulation

    Expected signal: IIS access log records a POST to /kentico/cmsformcontrols/uploader.ashx with a filename parameter containing '../..' sequences; file creation event may appear in Windows Security log under w3wp.exe

  2. Test 2Encoded Path Traversal Bypass Attempt

    Expected signal: IIS log shows double-encoded percent sequences in the request URL; WAF logs may show allowed request if only basic traversal patterns are blocked

  3. Test 3Web Shell Execution Post-Exploit Simulation

    Expected signal: Windows Security Event ID 4663 fires for file creation under w3wp.exe; DeviceFileEvents in Defender shows .aspx file written by w3wp.exe; subsequent HTTP GET to the shell path appears in IIS logs

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP(s) triggering the alert and determine whether they are internal, known scanner ranges, or external threat actors; cross-reference with threat intelligence feeds.
  2. Review the full HTTP request including headers, body size, and response code — a 200 response to a POST containing traversal sequences strongly indicates successful exploitation; a 500 may indicate a partial attempt.
  3. Inspect the IIS/web server file system at the Kentico application root and all parent directories for newly created or recently modified files with extensions .aspx, .ashx, .asmx, .php, .jsp, or .config within the past 24 hours.
  4. Check IIS worker process (w3wp.exe) for any child process spawning — web shell execution typically results in w3wp.exe spawning cmd.exe, powershell.exe, or net.exe.

Containment

  1. If active exploitation is confirmed, immediately block the source IP(s) at the perimeter firewall and WAF, and disable the vulnerable Kentico upload endpoint via IIS request filtering rules until patching is complete.
  2. Isolate the affected web server from internal network segments to prevent lateral movement if a web shell has been deployed; redirect legitimate traffic to a clean standby instance if available.

Evidence Collection

  1. Preserve a full copy of IIS access logs, error logs, and Windows Event Logs (Security, System, Application) from the affected host, covering at minimum 48 hours prior to detection.
  2. Collect a forensic image or at minimum a file system listing (with hash and timestamps) of the Kentico application directory and all subdirectories to identify planted web shells or modified files.

Escalation Criteria

  • !Escalate immediately if any web shell file is found on disk or if w3wp.exe is observed spawning interactive processes — this indicates full Remote Code Execution and should trigger IR procedures.
  • !Escalate if outbound connections from the web server to external IPs are observed post-exploitation, indicating possible C2 communication or data exfiltration.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS W3C access log entries with URI fields containing double-dot sequences (%2e%2e, ../, ..%2f) targeting /kentico/ or /cmspages/ paths
  • >Newly created .aspx or .ashx files in non-standard Kentico directories (outside /CMSTemplates/ or /CMSPages/) with timestamps correlating to the attack window
  • >Windows Security Event ID 4663 (file creation auditing) for executable-type files written by the w3wp.exe process
  • >Kentico CMS event log entries (stored in the CMS_EventLog database table) showing file upload operations with anomalous destination paths

Tuning Guidance

Reduce false positives by scoping the query to only servers running Kentico Xperience (filter by hostname, IIS site name, or server tag). Add a whitelist of known IP ranges for authorized vulnerability scanners. If the organization uses Kentico's built-in media library, create an allowlist of legitimate upload paths and exclude them from traversal detection. Consider raising the threshold to require both a path traversal pattern AND a suspicious file extension match to reduce noise from generic scanners. For the process-spawning query, baseline normal w3wp.exe child processes in your environment before alerting — some .NET monitoring agents legitimately spawn sub-processes from IIS.

Hunting Queries

Hunts for IIS worker process (w3wp.exe) spawning suspicious child processes, which is a strong indicator of web shell execution following successful CVE-2025-2749 exploitation.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(72h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "net.exe", "whoami.exe", "ipconfig.exe", "certutil.exe", "curl.exe", "wget.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=windows EventCode=4688 ParentImage="*\\w3wp.exe"
| where Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\net.exe", "*\\whoami.exe", "*\\certutil.exe", "*\\curl.exe")
| table _time, host, Image, CommandLine, ParentCommandLine, User

Hunts for w3wp.exe creating or writing script/executable files in Kentico application directories, indicating web shell deployment via CVE-2025-2749.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(72h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileExtension in~ ("aspx", "asp", "ashx", "asmx", "php", "jsp", "config")
| where FolderPath !has "\\Temp\\"
| project TimeGenerated, DeviceName, FolderPath, FileName, FileExtension, InitiatingProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog EventCode=4663 ObjectType=File
| where match(ObjectName, "(?i)\.(aspx|asp|ashx|php|jsp|config)$")
| where match(ProcessName, "(?i)w3wp\.exe")
| where Accesses IN ("WriteData", "CreateFile")
| table _time, host, ObjectName, ProcessName, SubjectUserName

Atomic Red Team Tests

Test 1 Kentico Path Traversal Upload Simulation
linux

Simulates an attacker sending a multipart POST request to a Kentico file upload endpoint with a path traversal sequence in the filename parameter, attempting to write a file outside the intended upload directory.

Command

bash 
curl -s -o /dev/null -w "%{http_code}" -X POST 'http://TARGET_HOST/kentico/cmsformcontrols/uploader.ashx' \
  -H 'Content-Type: multipart/form-data' \
  -F 'file=@/tmp/test.txt;filename=../../inetpub/wwwroot/test_traversal.aspx' \
  -F 'action=upload' \
  -A 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'

Cleanup

bash 
# On the target server (if request succeeded): Remove-Item C:\inetpub\wwwroot\test_traversal.aspx -ErrorAction SilentlyContinue

Expected Telemetry

IIS access log records a POST to /kentico/cmsformcontrols/uploader.ashx with a filename parameter containing '../..' sequences; file creation event may appear in Windows Security log under w3wp.exe

Expected Detection

KQL and SPL queries trigger on the path traversal pattern in the request URI; Elastic EQL sequence rule fires if a corresponding .aspx file is created on disk

Test 2 Encoded Path Traversal Bypass Attempt
linux

Tests double URL-encoding bypass of WAF rules that only detect literal '../' by encoding the traversal sequence as %252e%252e%252f.

Command

bash 
curl -s -o /dev/null -w "%{http_code}" -X POST 'http://TARGET_HOST/kentico/uploadfile/%252e%252e%252f%252e%252e%252fwebshell.aspx' \
  -H 'Content-Type: application/octet-stream' \
  --data-binary '<%@ Page Language="C#" %><% Response.Write("test"); %>' \
  -A 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)'

Cleanup

bash 
# Check for and remove any created file: Get-ChildItem -Path C:\inetpub -Recurse -Filter webshell.aspx | Remove-Item

Expected Telemetry

IIS log shows double-encoded percent sequences in the request URL; WAF logs may show allowed request if only basic traversal patterns are blocked

Expected Detection

Chronicle YARA-L and QRadar AQL rules that match on %252e trigger; Sumo Logic toLowerCase normalization catches the encoded variant

Test 3 Web Shell Execution Post-Exploit Simulation
windows

Simulates post-exploitation behavior by invoking a pre-placed test web shell (non-malicious) via HTTP GET to confirm RCE detection coverage from spawned processes.

Command

powershell 
# Step 1: Place a benign test shell (lab only, no real commands)
Set-Content -Path 'C:\inetpub\wwwroot\kentico\test_shell_probe.aspx' -Value '<%@ Page Language="C#" %><% Response.Write(System.Environment.MachineName); %>'
# Step 2: Request it
Invoke-WebRequest -Uri 'http://localhost/kentico/test_shell_probe.aspx' -UseBasicParsing | Select-Object -ExpandProperty Content

Cleanup

powershell 
Remove-Item 'C:\inetpub\wwwroot\kentico\test_shell_probe.aspx' -ErrorAction SilentlyContinue

Expected Telemetry

Windows Security Event ID 4663 fires for file creation under w3wp.exe; DeviceFileEvents in Defender shows .aspx file written by w3wp.exe; subsequent HTTP GET to the shell path appears in IIS logs

Expected Detection

Elastic EQL sequence rule correlates the file creation event with the preceding POST; hunting query for w3wp.exe-written script files triggers in KQL and SPL

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1083File and Directory Discovery

Same Tactic: Initial Access

Popular Detections