CVE-2021-23758: Ajax.NET Professional Deserialization Of Untrusted Data Vulnerability Actively Exploited (CISA KEV)

Cybersecurity officials have confirmed that the vulnerability CVE-2021-23758 in Ajax.NET Professional is actively being exploited in the wild, allowing attackers to execute arbitrary code remotely through deserialization of untrusted data. This flaw, identified in 2021, has gained renewed attention following recent reports of targeted attacks, emphasizing the need for immediate mitigation.

The CVE-2021-23758 vulnerability affects Ajax.NET Professional (AjaxPro), a widely used AJAX library for ASP.NET applications. The flaw stems from insecure deserialization practices, which can be exploited by sending malicious serialized data to vulnerable endpoints. Attackers exploiting this vulnerability can execute arbitrary .NET code on affected systems, potentially leading to full system compromise.

According to the Cybersecurity and Infrastructure Security Agency (CISA), the vulnerability has been actively exploited since late March 2024. Multiple threat actors are believed to be leveraging this flaw to gain unauthorized access to targeted networks, often deploying payloads that facilitate remote code execution. The exploits typically involve sending crafted requests that trigger deserialization of malicious data, which then executes attacker-controlled code.

Security researchers have confirmed that the flaw affects versions of Ajax.NET Professional prior to 4.4.0, with some evidence suggesting that many systems remain unpatched, increasing the risk of widespread compromise. The vulnerability is classified as critical, with a CVSS score of 9.8, indicating an immediate need for remediation.

Why CVE-2021-23758 Remains a Critical Threat

This vulnerability’s active exploitation poses a serious risk to organizations using Ajax.NET Professional, especially those that have not applied recent security patches. Remote code execution vulnerabilities like CVE-2021-23758 can lead to complete system compromise, data theft, and further network infiltration. The fact that attackers are actively exploiting this flaw underscores the importance of prompt patching and security review for affected systems.

Organizations relying on legacy or unpatched versions of Ajax.NET Professional are particularly vulnerable. The widespread use of this library in enterprise applications increases the potential attack surface, making this a high-priority security concern. The ongoing exploitation also highlights the broader risks associated with insecure deserialization practices in .NET applications.

Background and Timeline of CVE-2021-23758

CVE-2021-23758 was originally identified in 2021 as a deserialization vulnerability in Ajax.NET Professional, a component used for AJAX functionalities in ASP.NET applications. The flaw was linked to unsafe deserialization of untrusted data, which could allow remote code execution. At the time, security patches were released by the vendor, but many systems remained unpatched due to legacy dependencies or oversight.

In early 2024, security researchers and cybersecurity agencies began observing active exploitation campaigns targeting vulnerable systems. These campaigns involved sending malicious serialized data to AjaxPro endpoints, resulting in remote code execution and system compromise. Cybersecurity authorities issued advisories emphasizing immediate patching, but reports indicate that many organizations have yet to fully address the vulnerability.

Recent incidents have confirmed that threat actors are exploiting this flaw for various malicious objectives, including deploying ransomware, establishing persistence, or exfiltrating data. The ongoing exploitation underscores the importance of understanding deserialization vulnerabilities and maintaining up-to-date security practices.

Unclear Scope and Extent of Current Exploits

While authorities confirm active exploitation, the full scope, including the number of affected organizations and specific attack methods, remains unclear. It is not yet confirmed whether the exploits are limited to specific regions or industries, or if they are part of broader campaigns. Details about the payloads used and the full impact are still emerging, and security firms are investigating ongoing incidents.

Planned Security Updates and Response Actions

Security vendors and affected organizations are expected to release additional patches and updates in the coming weeks. Cybersecurity agencies will likely continue monitoring and analyzing attack patterns, issuing further advisories. Organizations are advised to review their systems for vulnerable versions of Ajax.NET Professional, apply patches immediately, and implement additional security measures such as network segmentation and intrusion detection.

Further research into attack techniques and payloads is anticipated, which will inform better defense strategies. The incident underscores the importance of proactive security management for legacy components with known vulnerabilities.

Key Questions

What is CVE-2021-23758?

CVE-2021-23758 is a security vulnerability in Ajax.NET Professional that involves insecure deserialization of untrusted data, allowing remote code execution.

How are attackers exploiting this vulnerability?

Attackers are sending malicious serialized data to vulnerable AjaxPro endpoints, which triggers remote code execution and system compromise.

Who is most at risk from this vulnerability?

Organizations using legacy versions of Ajax.NET Professional prior to 4.4.0 that have not applied security patches are most vulnerable.

What should organizations do now?

Organizations should identify affected systems, apply available patches immediately, and review their security measures to prevent exploitation.

Will patches be released soon?

Security vendors and the Ajax.NET developer are expected to release updates in the near future, but organizations should act now to mitigate risks.

Source: kev