CVE-2020-13166: Mylittleadmin RCE Vulnerability

CVE-2020-13166 Overview

CVE-2020-13166 is a pre-authentication remote code execution vulnerability in MyLittleAdmin 3.8, a web-based Microsoft SQL Server management tool commonly bundled with Plesk. The vulnerability stems from a hardcoded machineKey value in the application's web.config file. Because every customer installation shares the same key, attackers can craft a malicious __VIEWSTATE parameter containing serialized ASP.NET code that the server will deserialize and execute. The flaw is classified under CWE-798: Use of Hard-coded Credentials and requires no authentication or user interaction to exploit.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary code execution on any MyLittleAdmin 3.8 installation by forging ASP.NET ViewState payloads signed with the publicly known machineKey.

Affected Products

MyLittleTools MyLittleAdmin 3.8
Plesk installations bundling MyLittleAdmin 3.8
Microsoft SQL Server environments managed through MyLittleAdmin 3.8

Discovery Timeline

2020-05-19 - CVE-2020-13166 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-13166

Vulnerability Analysis

The vulnerability is an insecure deserialization issue triggered through ASP.NET ViewState handling. ASP.NET protects ViewState integrity by signing it with the machineKey configured in web.config. When the same key is shipped to every customer, that protection collapses. An attacker who possesses the key can sign arbitrary serialized .NET objects, submit them in the __VIEWSTATE parameter, and force the server to deserialize attacker-controlled gadgets. Public tooling such as ysoserial.net can generate TypeConfuseDelegate or ActivitySurrogateSelector gadget chains that translate ViewState deserialization into operating-system command execution under the IIS worker process identity. The Exploit-DB and SSD Disclosure advisories confirm functional exploit code is available, and the high EPSS probability indicates active scanning interest from threat actors.

Root Cause

The MyLittleAdmin 3.8 distribution ships a web.config containing static validationKey and decryptionKey values inside the <machineKey> element. Because these values are identical across all deployments, the secret required to sign trusted ViewState payloads is effectively public. ASP.NET treats any payload signed with this key as legitimate and proceeds to deserialize it.

Attack Vector

Exploitation is performed remotely over HTTP or HTTPS against any page that processes ViewState, typically the MyLittleAdmin login endpoint. The attacker generates a serialized .NET gadget chain, signs it with the leaked machineKey, and sends it in a POST request as the __VIEWSTATE parameter. The server validates the MAC, deserializes the object, and executes the embedded command. No credentials, tokens, or prior access are required.

No verified proof-of-concept code is reproduced here. See the SSD Disclosure Advisory and the Packet Storm Security Exploit for full technical details and exploitation steps.

Detection Methods for CVE-2020-13166

Indicators of Compromise

Unusually large __VIEWSTATE parameters submitted to MyLittleAdmin endpoints, particularly /mylittleadmin/
IIS worker process (w3wp.exe) spawning child processes such as cmd.exe, powershell.exe, or certutil.exe
Outbound network connections initiated by w3wp.exe to unknown hosts shortly after POST requests to MyLittleAdmin URLs
Web shells or unexpected .aspx files written to MyLittleAdmin web directories

Detection Strategies

Inspect IIS logs for POST requests to MyLittleAdmin pages containing oversized or base64-encoded __VIEWSTATE values
Hunt for process-tree anomalies where w3wp.exe is the parent of command interpreters or scripting hosts
Apply YARA or signature rules targeting known ysoserial.net gadget byte patterns inside HTTP request bodies
Compare the <machineKey> values in deployed web.config files against the known hardcoded key to identify vulnerable installations

Monitoring Recommendations

Forward IIS, Windows Security, and Sysmon process-creation logs to a centralized analytics platform for correlation
Alert on any child process spawned by w3wp.exe that is not on an approved allowlist for the application pool
Monitor file integrity on MyLittleAdmin installation directories to detect newly dropped scripts or binaries

How to Mitigate CVE-2020-13166

Immediate Actions Required

Identify all MyLittleAdmin 3.8 deployments, including instances bundled inside Plesk, and isolate them from untrusted networks
Replace the default hardcoded <machineKey> in web.config with cryptographically random validationKey and decryptionKey values unique to each installation
Restrict access to MyLittleAdmin endpoints with IP allowlisting or VPN-only access until remediation is complete
Review IIS and web server logs for prior exploitation attempts and conduct host forensics on exposed servers

Patch Information

MyLittleAdmin 3.8 is the final affected release identified in the advisory, and no upstream vendor patch is referenced in the NVD record. Administrators should rotate machineKey values manually, migrate to an alternative SQL Server management tool, or remove MyLittleAdmin from internet-facing systems. Plesk operators should consult Plesk advisories for guidance on disabling the component.

Workarounds

Generate unique machineKey values per server using the IIS Manager Machine Key feature and redeploy web.config
Enable ViewState MAC validation enforcement and set EnableViewStateMac="true" along with ViewStateEncryptionMode="Always"
Block external access to /mylittleadmin/ URLs at the web application firewall and require source-IP restrictions
Uninstall MyLittleAdmin where it is no longer required and remove residual files from the IIS web root

bash

# Configuration example: replace hardcoded machineKey in web.config
# Generate new keys with PowerShell, then update the <system.web> section

# 1. Generate random 64-byte validation key and 32-byte decryption key
powershell -Command "[byte[]]$vk = New-Object byte[] 64; \
  (New-Object Security.Cryptography.RNGCryptoServiceProvider).GetBytes($vk); \
  ($vk | ForEach-Object { $_.ToString('X2') }) -join ''"

powershell -Command "[byte[]]$dk = New-Object byte[] 32; \
  (New-Object Security.Cryptography.RNGCryptoServiceProvider).GetBytes($dk); \
  ($dk | ForEach-Object { $_.ToString('X2') }) -join ''"

# 2. Update web.config <system.web> with the new values:
#    <machineKey
#      validationKey="<NEW_VALIDATION_KEY>"
#      decryptionKey="<NEW_DECRYPTION_KEY>"
#      validation="HMACSHA256"
#      decryption="AES" />

# 3. Recycle the IIS application pool
%windir%\system32\inetsrv\appcmd recycle apppool /apppool.name:"MyLittleAdminPool"