CVE-2021-23758: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Overview
Ajax.NET Professional (AjaxPro) deserializes incoming AJAX request data without restricting which .NET types may be instantiated, allowing an unauthenticated remote attacker to achieve code execution on the server. All versions of the AjaxPro.2 NuGet package prior to 21.10.30.1 are affected. Cisco Talos has reported active exploitation of this vulnerability by UAT-10147, a Chinese-speaking threat group targeting internet-exposed web servers across government, education, media, and technology sectors.
Vulnerability details
Ajax.NET Professional is a .NET library that handles AJAX communication between client and server by serializing and deserializing .NET objects. The library accepted serialized payloads from incoming requests without enforcing any allowlist of permitted types. Under CWE-502, this means attacker-controlled data crosses a trust boundary and is passed directly to the deserializer, which instantiates arbitrary .NET classes. By selecting classes already present on the application's classpath, an attacker can chain their methods into a gadget sequence that executes operating system commands before any type-safety check occurs.
An attacker sends a crafted serialized .NET object payload to the application's AjaxPro AJAX endpoint over the network. No authentication is required and no user interaction is needed. When the library deserializes the payload, the gadget chain executes with the privileges of the hosting process, giving the attacker full remote code execution. Cisco Talos observed UAT-10147 using this access to deploy web shells, run privilege escalation tools such as EfsPotato, install QuasarRAT, and modify Windows Defender exclusion lists to maintain persistence.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor IIS or application-level request logs for POST requests to AjaxPro handler endpoints (typically paths containing 'ajaxpro' or ending in '.ashx') where the request body contains serialized type references to unexpected or system-level .NET classes outside the application's normal object set.
- Alert on child processes spawned by the web server worker process (w3wp.exe or equivalent) that are not part of the application's normal operation, such as cmd.exe, powershell.exe, or certutil.exe, which are consistent with gadget-chain execution following deserialization.
- Look for Windows Registry modifications or PowerShell invocations that add paths to the Windows Defender exclusion list originating from the web server process, a post-exploitation indicator specifically noted in UAT-10147 intrusions exploiting this vulnerability.
Remediation
Additional hardening
- Upgrade AjaxPro.2 to version 21.10.30.1 or later, which introduces an allowlist restricting which .NET types the library will deserialize; applications that cannot be upgraded should be taken offline or isolated from internet exposure.
- Restrict network access to AjaxPro AJAX endpoints at the perimeter or WAF layer, permitting requests only from known, trusted client IP ranges rather than the open internet.
- Run the IIS application pool hosting AjaxPro under a least-privilege service account with no ability to write to system directories, modify registry keys, or spawn child processes, limiting the impact of successful gadget-chain execution.
- Deploy application-layer monitoring or a WAF rule that inspects POST body content to AjaxPro handler paths for serialized payloads referencing type names outside an expected allowlist, and block or alert on anomalous type references.
Key dates
References
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2021-23758
- http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
- https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
- https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758
Frequently asked questions
Does CVE-2021-23758 affect my FedRAMP authorization?
If Ajax.NET Professional runs inside your authorization boundary, yes. CVE-2021-23758 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of September 9, 2026. For a FedRAMP-authorized service, an unpatched KEV within the boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it as a deficiency.
How does Knox help me handle CVE-2021-23758?
Knox does not patch Ajax.NET Professional for you. Remediation is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that remediation, along with continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. Applying the patch is yours to own; managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2021-23758. When exposure surfaces through ongoing monitoring rather than only at an assessor's scheduled review, you retain time to act before a finding becomes a formal deficiency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2021-23758 isn't remediated by September 9, 2026?
If CVE-2021-23758 is not remediated by September 9, 2026, it becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Meeting the deadline keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
