CVE-2021-23758

What it actually does

This vulnerability affects vulnerable builds of Ajax.NET Professional and Debian 10 OpenImageIO packages as listed. In the Ajax.NET Professional context, the risk is unsafe handling of attacker-controlled serialized input, which can allow a remote attacker to influence server-side object creation and potentially execute code in the context of the web application. In the OpenImageIO context, exposure is through processing attacker-supplied image content with a vulnerable library version, which can lead to memory corruption, application crashes, or potentially code execution depending on how the library is invoked and sandboxed. The high EPSS score and weaponized exploit maturity indicate that practical exploitation is likely and should be treated as urgent even though the issue is not currently listed in CISA KEV.

Why it matters to the business

Successful exploitation can let an attacker take control of an affected web application or disrupt systems that process untrusted images, leading to service outages, unauthorized data access, malware deployment, lateral movement, or compromise of downstream systems. Because exploit maturity is listed as weaponized and EPSS is very high, internet-facing or file-processing workloads using affected versions should be prioritized for emergency review and remediation.

How an attack unfolds

An attacker first identifies an application or service using a vulnerable affected component. For Ajax.NET Professional, the attacker probes for exposed Ajax.NET handler endpoints, then sends crafted serialized data designed to trigger unsafe server-side deserialization or object handling. If exploitation succeeds, code may run under the application pool or service account, allowing command execution, web shell deployment, credential access, or further internal reconnaissance. For OpenImageIO, the attacker supplies a malicious image file through an upload workflow, batch conversion job, thumbnailing service, rendering pipeline, or other path that causes the vulnerable library to parse the file. Successful exploitation may crash the process or, in severe cases, execute attacker-controlled code with the privileges of the image-processing service.

How to fix it

Upgrade affected components to fixed versions. For Debian 10 OpenImageIO, install version 2.0.5~dfsg0-1+deb10u2 or later from the appropriate security repository. For michaelschwarz/ajax.net-professional, update to a version containing commit b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 or later. If immediate patching is not possible, restrict access to Ajax.NET handler endpoints, block unauthenticated access where feasible, disable unused Ajax.NET Professional functionality, reject untrusted serialized payloads, and place affected applications behind a WAF rule that inspects request bodies for deserialization indicators. For OpenImageIO workloads, prevent vulnerable services from processing untrusted images, isolate image-processing jobs in containers or sandboxes, disable unnecessary image formats if possible, and run processors with least privilege and no write access outside required working directories.

How to confirm the fix worked

Confirm package and dependency versions directly on hosts and in build artifacts. On Debian 10 systems, verify the installed openimageio package version is 2.0.5~dfsg0-1+deb10u2 or later using package inventory tooling such as dpkg or vulnerability scanners. For Ajax.NET Professional, confirm the deployed source, package, or binary includes commit b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 or a later fixed release. Review SBOMs, dependency lockfiles, container images, and deployment bundles to ensure no vulnerable copies remain. Validate compensating controls by confirming exposed Ajax.NET endpoints are authenticated or restricted and that upload/image-processing services cannot process untrusted files with vulnerable libraries. Retest externally visible applications with safe, non-exploitative checks for exposed Ajax.NET handler paths and confirm WAF or access-control rules are active.

Typical attack path

1. Identify internet-facing applications, APIs, upload portals, media-processing services, or developer frameworks using affected versions of Ajax.NET Professional or OpenImageIO.
2. Probe for exposed Ajax.NET Professional handler paths or image-processing workflows that accept untrusted input.
3. Send crafted serialized payloads to vulnerable Ajax.NET endpoints or upload specially crafted image files to workflows backed by vulnerable OpenImageIO packages.
4. Trigger vulnerable parsing or deserialization behavior on the server side.
5. Achieve process crash, application compromise, or remote code execution depending on the affected component and runtime protections.
6. Deploy persistence such as a web shell, execute commands, collect credentials, or move laterally if code execution is achieved.

How to detect it

Review historical and current telemetry for signs of exploitation. For Ajax.NET Professional, inspect web server, reverse proxy, WAF, and application logs for unusual POST requests to Ajax.NET handler endpoints, especially requests containing serialized type metadata, .NET class names, command execution strings, encoded PowerShell, or unusually large request bodies. Correlate suspicious requests with process telemetry showing web server worker processes spawning shells or administrative tools. Look for new or modified ASPX files, unexpected DLLs, scheduled tasks, service creation, or outbound connections shortly after suspicious requests. For OpenImageIO, inspect upload, media-processing, conversion, and thumbnailing logs for malformed image processing failures, segmentation faults, repeated worker crashes, or files submitted immediately before process failure. Correlate with endpoint telemetry showing image-processing tools or services spawning unexpected child processes, writing executable files, or making outbound network connections. Because no KEV entry is present but exploit maturity is weaponized and EPSS is high, treat suspicious indicators around exposed endpoints or file-processing services as high priority.

• /ajaxpro/
• AjaxPro.ashx
• POST /ajaxpro/
• __type
• $type
• System.Diagnostics.Process
• System.Windows.Data.ObjectDataProvider
• System.Configuration.Install.AssemblyInstaller
• cmd.exe
• powershell.exe
• /bin/sh
• /bin/bash
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• dotnet spawning cmd.exe
• dotnet spawning powershell.exe
• *.aspx web shell created under web root
• oiiotool
• maketx
• OpenImageIO
• Segmentation fault
• SIGSEGV
• AddressSanitizer
• heap-buffer-overflow

What your security team should do

• Prioritize remediation for internet-facing web applications using Ajax.NET Professional and any services that process untrusted image files with OpenImageIO.
• Patch Debian 10 OpenImageIO to 2.0.5~dfsg0-1+deb10u2 or later and update Ajax.NET Professional to a build containing commit b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 or later.
• Inventory applications, containers, CI/CD artifacts, and vendor software for embedded or bundled vulnerable copies of the affected components.
• Restrict or block unauthenticated access to Ajax.NET Professional handler endpoints until patching is complete.
• Temporarily isolate or sandbox image-processing services that accept external files, especially thumbnailing, conversion, rendering, and media-ingestion pipelines.
• Add logging and detection coverage for suspicious Ajax.NET POST requests, deserialization payload markers, abnormal child processes spawned by web servers, image-processing crashes, and unexpected web shell creation.
• Review recent logs for signs of exploitation because weaponized exploit maturity and high EPSS indicate meaningful likelihood of prior targeting.
• Rotate credentials and investigate lateral movement if evidence shows command execution, suspicious child processes, or web shell deployment from an affected service account.