erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: December 3, 2021

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: AjaxPro CVE-2021-23758: Old ASP.NET RCE Now in CISA KEV. Owners of ASP.NET Web Forms applications, in-house or bought from a vendor, that bundle AjaxPro.2.dll or register the ajaxpro/*.ashx handler, most urgently on internet-facing servers.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2021-23758

AjaxPro CVE-2021-23758: Old ASP.NET RCE Now in CISA KEV

If an ASP.NET app you run still ships AjaxPro, treat it as an unauthenticated RCE and upgrade or remove the library now; if you never used AjaxPro, there is nothing to do.

Must act: Owners of ASP.NET Web Forms applications, in-house or bought from a vendor, that bundle AjaxPro.2.dll or register the ajaxpro/*.ashx handler, most urgently on internet-facing servers.

Can relax: Teams on ASP.NET Core or other stacks that never referenced AjaxPro, AjaxNetProfessional, AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro.

  1. Search source trees, build output and IIS servers for AjaxPro.2.dll, AjaxPro references in .csproj or packages.config, and ajaxpro/*.ashx handlers in web.config.
  2. Replace AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro with the official AjaxNetProfessional package at 21.12.22.1 or later, then rebuild and redeploy.
  3. Keep custom JSON deserialization types deny-by-default and allow only your own namespaces.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.