CVE-2021-27852

What it actually does

Checkbox Survey versions prior to 7 contain an unauthenticated deserialization vulnerability in CheckboxWeb.dll. Because attacker-controlled serialized data can be processed by the application, a remote attacker can cause the server to instantiate unsafe objects and execute arbitrary code in the context of the web application process. Successful exploitation can provide full compromise of the application, including confidentiality, integrity, and availability impact, and may allow further operating-system-level actions depending on the service account permissions.

Why it matters to the business

A vulnerable internet-facing Checkbox Survey instance can be taken over without credentials, allowing attackers to steal survey data, alter application content, deploy malware or web shells, disrupt service, and use the server as a foothold into the wider network. The vulnerability is listed in CISA KEV with a remediation due date of 2022-05-02 and has active in-the-wild exploitation, so unpatched systems should be treated as high-priority exposure even though it is an older issue.

How an attack unfolds

An attacker identifies a Checkbox Survey deployment running a version prior to 7 and sends a specially crafted unauthenticated request containing malicious serialized data to functionality handled by CheckboxWeb.dll. The application deserializes the untrusted payload, triggering attacker-controlled object behavior and executing commands or code on the server. The attacker may then write a web shell, launch system commands under the web server account, dump application data, modify survey content, stage additional tools, or pivot using any credentials or network access available to the compromised host.

How to fix it

Upgrade Checkbox Survey to version 7 or later. If immediate upgrade is not possible, restrict external access to the application using VPN, allowlists, or reverse-proxy access controls; disable or isolate vulnerable Checkbox Survey instances; and ensure the application runs with the least-privileged service account possible. Because this is unauthenticated remote code execution and is in CISA KEV, compensating controls should be considered temporary only. After patching, rotate credentials and secrets accessible to the application if exploitation is suspected, and review the web root and application directories for unauthorized files.

How to confirm the fix worked

Confirm the installed Checkbox Survey version is 7 or later through the product administrative interface, application files, or vendor-supported inventory method. Validate that no public-facing instance remains on a version prior to 7 using asset inventory, vulnerability scanning, and external attack-surface monitoring. Confirm web server access controls are enforced if the system cannot be upgraded immediately. After remediation, review application behavior and logs for failed or successful attempts to submit unusual serialized payloads, unexpected HTTP 500 errors, creation of new files in web-accessible directories, and suspicious child processes spawned by the web server or application pool identity.

Typical attack path

1. Scan the internet or target network for exposed Checkbox Survey instances.
2. Fingerprint the application to determine whether it is running a version prior to 7.
3. Send a crafted unauthenticated request containing a malicious serialized payload to the vulnerable CheckboxWeb.dll-handled endpoint or application path.
4. Achieve arbitrary code execution in the context of the Checkbox Survey web application process.
5. Establish persistence, commonly by uploading or writing a web shell or secondary payload to a web-accessible directory.
6. Run reconnaissance commands, access application data, collect credentials or configuration secrets, and attempt lateral movement.
7. Cover tracks by deleting payloads, modifying timestamps, or clearing application and web server logs.

How to detect it

To determine whether exploitation already occurred, review IIS/web server access logs, Checkbox Survey application logs, Windows Event Logs, EDR telemetry, and file integrity data for the vulnerable period. Focus on unauthenticated requests to Checkbox Survey paths that produced HTTP 500 errors, long or encoded request bodies, unusual POSTs, or requests followed by new file creation or process execution. On Windows hosts, look for w3wp.exe or the Checkbox Survey application process spawning cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, certutil.exe, bitsadmin.exe, rundll32.exe, regsvr32.exe, or other living-off-the-land tools. Inspect web-accessible directories for newly created or modified .aspx, .ashx, .asmx, .config, .dll, .ps1, .bat, or .exe files. Correlate inbound exploit-like HTTP requests with subsequent outbound connections, new scheduled tasks, service creation, account changes, archive creation, credential access activity, or lateral movement attempts. Because public reporting does not provide a universal payload string for this CVE, detection should emphasize behavioral evidence of deserialization-triggered code execution rather than a single fixed signature.

• CheckboxWeb.dll
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• .aspx file created in Checkbox Survey web directory
• .ashx file created in Checkbox Survey web directory
• .asmx file created in Checkbox Survey web directory
• POST requests to Checkbox Survey followed by HTTP 500 responses
• POST requests referencing CheckboxWeb.dll
• /bin/CheckboxWeb.dll

What your security team should do

• Immediately identify all Checkbox Survey deployments, especially internet-facing instances, and prioritize any version prior to 7 for remediation.
• Upgrade to Checkbox Survey version 7 or later; if unavailable, remove the system from internet exposure until it can be upgraded or replaced.
• Treat vulnerable exposed systems as potentially compromised due to active in-the-wild exploitation and KEV status.
• Review web server, application, EDR, and file integrity logs for evidence of deserialization exploitation, web shell creation, and suspicious process execution.
• Hunt for web server processes spawning command shells, PowerShell, script interpreters, or network utilities.
• Inspect Checkbox Survey application directories and web roots for recently modified or suspicious ASPX, DLL, config, or script files.
• Rotate application database credentials, service account passwords, API keys, and other secrets accessible from the Checkbox Survey host if compromise cannot be ruled out.
• Apply network segmentation and least-privilege execution for the web application to reduce post-exploitation impact.
• Create SIEM detections for suspicious requests to Checkbox Survey endpoints and for abnormal child processes launched by IIS or the Checkbox Survey application process.