Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Distant Code Execution

Aug 29, 2025Ravie LakshmananVulnerability / Internet Safety

Three new safety vulnerabilities have been disclosed within the Sitecore Expertise Platform that may very well be exploited to attain info disclosure and distant code execution.

The issues, per watchTowr Labs, are listed beneath –

• CVE-2025-53693 – HTML cache poisoning via unsafe reflections
• CVE-2025-53691 – Distant code execution (RCE) via insecure deserialization
• CVE-2025-53694 – Data Disclosure in ItemService API with a restricted nameless person, resulting in publicity of cache keys utilizing a brute-force strategy

Patches for the primary two shortcomings had been launched by Sitecore in June and for the third in July 2025, with the corporate stating that “profitable exploitation of the associated vulnerabilities may result in distant code execution and non-authorized entry to info.”

The findings construct on three extra flaws in the identical product that had been detailed by watchTowr again in June –

• CVE-2025-34509 (CVSS rating: 8.2) – Use of hard-coded credentials
• CVE-2025-34510 (CVSS rating: 8.8) – Put up-authenticated distant code execution through path traversal
• CVE-2025-34511 (CVSS rating: 8.8) – Put up-authenticated distant code execution through Sitecore PowerShell Extension

watchTowr Labs researcher Piotr Bazydlo stated the newly uncovered bugs may very well be original into an exploit chain by bringing collectively the pre-auth HTML cache poisoning vulnerability with a post-authenticated distant code execution concern to compromise a fully-patched Sitecore Expertise Platform occasion.

Your complete sequence of occasions main as much as code execution is as follows: A menace actor may leverage the ItemService API, if uncovered, to trivially enumerate HTML cache keys saved within the Sitecore cache and ship HTTP cache poisoning requests to these keys.

This might then be chained with CVE-2025-53691 to produce malicious HTML code that finally leads to code execution by way of an unrestricted BinaryFormatter name.

“We managed to abuse a really restricted reflection path to name a technique that lets us poison any HTML cache key,” Bazydlo stated. “That single primitive opened the door to hijacking Sitecore Expertise Platform pages – and from there, dropping arbitrary JavaScript to set off a Put up-Auth RCE vulnerability.”