AIKIDO-2025-10397

TL;DR

Security researchers discovered a critical vulnerability chain (CVE-2025-34509, CVE-2025-34510, CVE-2025-34511) in Sitecore Experience Platform (XP) that can lead to pre-authenticated remote code execution. The issue stems from the use of a hard-coded password for the default sitecore\ServicesAPI user, which allows attackers to authenticate and interact with exposed administrative endpoints. Once authenticated, an attacker can upload a specially crafted ZIP file to trigger a path traversal vulnerability, ultimately placing a web shell in the server’s webroot. Additionally, a flaw in the Sitecore PowerShell Extensions permits unrestricted file uploads, enabling further code execution. These vulnerabilities affect installations starting from version 10.1, provided the default installer was used. While upgrades from earlier versions may be less exposed, the potential for exploitation remains high. Due to the widespread use of Sitecore in critical sectors like finance and aviation, users are urged to rotate credentials and apply security patches immediately.