Cloudanix VulnDB

CVE-2017-17736

Critical · 9.8

CVSS

9.8

EPSS

68.5%

Published

Mar 23, 2018

CISA due date

—

Cloudanix analysis

Act now SSVC: Attend

Anyone on the internet could reach a setup page and become the site's top administrator without logging in.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Privilege Gain
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw exposes the installation endpoint to unauthenticated visitors, allowing direct navigation into the administration dashboard and automatic elevation to Global Administrator rights.

Why it matters to the business

Attackers can seize complete control of the web application, risking data theft, site defacement, or persistent backdoors; the issue carries high exploitation probability given weaponized public exploits and a stable high EPSS score.

How an attack unfolds

An unauthenticated attacker directly requests the exposed CMSInstall/install.aspx page, bypasses any remaining setup checks, and lands on the CMS Administration Dashboard with full Global Administrator privileges.

How to fix it

Block or remove the CMSInstall directory from production deployments, enforce authentication on all administrative paths, and upgrade to a supported Kentico version that no longer ships the vulnerable installer endpoint.

How to confirm the fix worked

Confirm that direct requests to install.aspx return 403 or require prior authentication, review web-server access logs for prior hits on the path, and audit the administrator role membership for unexpected accounts.

Typical attack path

  1. Send an HTTP request to /CMSInstall/install.aspx without credentials
  2. Follow the resulting redirect or link to the CMS Administration Dashboard
  3. Receive Global Administrator session or role assignment

How to detect it

Examine web-server access logs for GET or POST requests to CMSInstall/install.aspx or CMSInstall paths; correlate any such entries with subsequent administrative login events or new user account creation.

  • /CMSInstall/install.aspx
  • CMSInstall/
  • install.aspx

What your security team should do

  • Immediately restrict public access to all installation-related paths via WAF or web-server rules
  • Scan historical logs for requests to CMSInstall/install.aspx and investigate any hits
  • Remove or rename installer files after initial deployment in all environments
  • Monitor EPSS and exploit availability for any remaining Kentico instances

The record

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.

Affected packages

Ecosystem Package Introduced Fixed
nuget Kentico.Libraries 10.0 10.0.48
nuget Kentico.Libraries 9.0 9.0.51

Related vulnerabilities