Sitecore CVE-2019-9874/9875: Anti-CSRF Deserialization RCE
These are six-year-old bugs with hotfixes since 2019 and 2020; the risk sits with forgotten Sitecore 6.6 to 8.2 sites and early 9.x installs that never got the anti-CSRF hotfix, which an unauthenticated POST can take over.
Must act: Owners of Sitecore CMS 6.6.3 through XP 8.2.7 without SC Hotfix 313001-1, and of Sitecore XP 9.0 through 9.1 Initial Release without the 313001-2 hotfix or an upgrade, especially with /sitecore/shell reachable from the internet.
Can relax: Sites on Sitecore XP 9.1 Update-1 or later, xDB Cloud environments, and older sites where the hotfix is verified and /sitecore/shell is restricted to trusted addresses.
- Inventory every Sitecore instance, including old marketing microsites, and record the exact version and update level.
- On 6.6 to 8.2, confirm SC Hotfix 313001-1 by comparing the SHA256 of bin\Sitecore.Security.AntiCsrf.dll with the value in Sitecore's bulletin; on 9.0 to 9.1 Initial Release, apply 313001-2 or upgrade.
- Restrict /sitecore/shell to trusted IP addresses with IIS rules, or deny it entirely on content-delivery servers.