Detect Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749) in Google Chronicle
Detects exploitation of CVE-2025-2749, a path traversal and unrestricted file upload vulnerability in Kentico Xperience CMS. Attackers can traverse directory boundaries to write arbitrary files — including web shells — to locations outside the intended upload path, enabling remote code execution on the hosting server. This CVE is listed in the CISA Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
YARA-L Detection Query
rule cve_2025_2749_kentico_path_traversal {
meta:
author = "df00tech Detection Platform"
description = "Detects path traversal exploitation attempts against Kentico Xperience CMS (CVE-2025-2749)"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2749"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.network.http.method = /POST|PUT/
(
$e.network.http.target_url = /\/kentico\//i nocase or
$e.network.http.target_url = /\/cmspages\//i nocase or
$e.network.http.target_url = /\/cmsformcontrols\//i nocase or
$e.network.http.target_url = /\/uploadfile\//i nocase
)
(
$e.network.http.target_url = /\.\.\//i or
$e.network.http.target_url = /%2e%2e/i or
$e.network.http.target_url = /%252e/i or
$e.network.http.target_url = /\.\.%2f/i or
$e.network.http.target_url = /\.\.%5c/i
)
condition:
$e
}Chronicle YARA-L rule detecting HTTP POST/PUT requests to Kentico Xperience CMS endpoints containing path traversal sequences that could exploit CVE-2025-2749.
Data Sources
Required Tables
False Positives & Tuning
- Authorized red team exercises targeting Kentico installations
- URL-encoded characters in legitimate multilingual or special-character filenames
- Third-party integrations using encoded path components in API calls to Kentico
Other platforms for CVE-2025-2749
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Kentico Path Traversal Upload Simulation
Expected signal: IIS access log records a POST to /kentico/cmsformcontrols/uploader.ashx with a filename parameter containing '../..' sequences; file creation event may appear in Windows Security log under w3wp.exe
- Test 2Encoded Path Traversal Bypass Attempt
Expected signal: IIS log shows double-encoded percent sequences in the request URL; WAF logs may show allowed request if only basic traversal patterns are blocked
- Test 3Web Shell Execution Post-Exploit Simulation
Expected signal: Windows Security Event ID 4663 fires for file creation under w3wp.exe; DeviceFileEvents in Defender shows .aspx file written by w3wp.exe; subsequent HTTP GET to the shell path appears in IIS logs
Unlock Pro Content
Get the full detection package for CVE-2025-2749 including response playbook, investigation guide, and atomic red team tests.