AjaxPro.2 Deserialization Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2021-23758)

1. Apply Official Patch

Review the official security patch commit and update your project dependencies to a secure version.

• GitHub Patch Commit: b0e63be5f0bb20dfce507cb8a1a9568f6e73de57

2. Temporary Mitigations

If patching is not immediately feasible, consider the following workarounds:

Restrict HTTP Handlers in web.config

Remove or restrict the AjaxPro HTTP handler registration if it is not actively required by the application.

<configuration>
  <system.webServer>
    <handlers>
      <!-- Remove AjaxPro handler if unused -->
      <remove name="AjaxPro" />
    </handlers>
  </system.webServer>
</configuration>

Web Application Firewall (WAF) Rules

Configure WAF rules to inspect incoming POST requests targeting AjaxPro endpoints for common .NET deserialization gadget signatures.

• Signature Keywords: System.Windows.Data.ObjectDataProvider, System.Diagnostics.Process, System.Configuration.Install.AssemblyInstaller, etc.

Vulnerability Overview

AjaxPro.2 (Ajax.NET Professional) is an open-source library used to handle asynchronous AJAX requests in .NET environments. This vulnerability (CVE-2021-23758) is a Deserialization of Untrusted Data (CWE-502) flaw that occurs when the library processes untrusted input without proper validation.

Exploit Mechanics & Impact

An attacker can send a specially crafted payload to the AjaxPro deserialization endpoint. This payload contains metadata to instantiate dangerous .NET gadget classes (such as System.Windows.Data.ObjectDataProvider).

When the AjaxPro engine deserializes this input, it instantiates the arbitrary .NET classes specified by the attacker, leading to arbitrary command execution (RCE) under the context of the web server process. This vulnerability has a CVSS score of 9.8 (Critical) and is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild.