CVE-2025-2794 Overview
CVE-2025-2794 is an unsafe reflection vulnerability in Kentico Xperience that allows an unauthenticated remote attacker to terminate the running application process. The flaw is classified under [CWE-470: Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)]. Successful exploitation results in a Denial-of-Service (DoS) condition affecting the availability of the web application. The issue affects Kentico Xperience versions through 13.0.180.
Critical Impact
Unauthenticated network attackers can remotely kill the Kentico Xperience worker process, taking the content management system offline without requiring user interaction.
Affected Products
- Kentico Xperience versions through 13.0.180
- Web applications and sites built on the affected Kentico Xperience platform
- Public-facing CMS deployments reachable from untrusted networks
Discovery Timeline
- 2025-03-31 - CVE-2025-2794 published to the National Vulnerability Database (NVD)
- 2025-11-04 - Last updated in NVD database
Technical Details for CVE-2025-2794
Vulnerability Analysis
The vulnerability resides in functionality that uses externally controlled input to influence reflection operations within Kentico Xperience. Reflection in .NET allows runtime resolution and invocation of types and methods. When unvalidated input reaches a reflection sink, an attacker can steer execution toward unintended methods.
In this case, an attacker can reach code paths that terminate the current worker process. Because the request requires no authentication and no user interaction, the attack can be repeated to maintain an outage. The result is a sustained loss of availability for the affected CMS instance.
Root Cause
The root cause is improper restriction of the types and methods that may be selected through reflection [CWE-470]. The affected component accepts attacker-supplied identifiers and resolves them into executable members without enforcing an allowlist. Without strict type and method filtering, a request can target process control APIs and cause the host process to exit.
Attack Vector
The attack vector is network-based and requires no credentials or user interaction. An attacker sends a crafted HTTP request to the vulnerable Kentico Xperience endpoint. The request supplies parameters that the application passes into reflection logic, which then dispatches to a method that kills the current process. Repeated requests prevent recovery and keep the service unavailable. For technical details, see the VulnCheck Advisory for Kentico.
Detection Methods for CVE-2025-2794
Indicators of Compromise
- Unexpected w3wp.exe or Kentico application pool process terminations recorded in Windows Event Log.
- Recurring HTTP 5xx responses or connection resets correlated with abnormal request patterns.
- IIS access logs containing requests with parameter values referencing fully qualified type names or method names.
- Application pool auto-restart events in IIS triggered immediately after specific inbound requests.
Detection Strategies
- Inspect web server logs for repeated requests to Kentico endpoints that precede process exits.
- Alert on short-interval crash loops in the Kentico worker process tied to a single source IP or user agent.
- Deploy WAF rules that flag request parameters containing .NET type identifiers or System. namespace strings.
Monitoring Recommendations
- Monitor process lifecycle telemetry for the Kentico application pool and alert on abnormal termination frequency.
- Track availability metrics and HTTP error rates against a baseline to identify sustained DoS conditions.
- Forward IIS, Windows, and application logs to a centralized analytics platform for correlation across hosts.
How to Mitigate CVE-2025-2794
Immediate Actions Required
- Apply the latest Kentico hotfix from the Kentico Hotfix Download page to upgrade beyond version 13.0.180.
- Restrict network exposure of Kentico administrative and API endpoints to trusted IP ranges where feasible.
- Place a Web Application Firewall (WAF) in front of the application and block requests carrying suspicious reflection parameters.
Patch Information
Kentico has published hotfixes addressing the unsafe reflection issue. Administrators should download and install the appropriate hotfix from the Kentico Hotfix Download portal and validate that the deployed build is later than 13.0.180. Refer to the VulnCheck Advisory for Kentico for additional remediation context.
Workarounds
- Enable rate limiting on the affected endpoints to slow repeated process-kill attempts.
- Configure IIS application pool rapid-fail protection and automatic recycling to reduce recovery time after a crash.
- Block or filter requests containing .NET type or method identifiers at the reverse proxy or WAF layer until patching is complete.
# Example IIS rapid-fail and recycling configuration via appcmd
appcmd set apppool "KenticoAppPool" /failure.rapidFailProtection:true
appcmd set apppool "KenticoAppPool" /failure.rapidFailProtectionMaxCrashes:5
appcmd set apppool "KenticoAppPool" /failure.rapidFailProtectionInterval:00:05:00
appcmd set apppool "KenticoAppPool" /recycling.periodicRestart.time:00:00:00
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
