AjaxPro RCE exploited in the wild (CVE-2021-23758) [PoC]

Actively exploited in the wild - CVE-2021-23758 is a critical deserialization vulnerability in all versions of the ajaxpro.2 package for .NET that grants unauthenticated remote code execution on the host server. This vulnerability is confirmed on CISA’s Known Exploited Vulnerabilities list, and with an EPSS score of 89.1%, exploitation attempts are expected within days.

Overview

CVE-2021-23758 affects every version of ajaxpro.2, a widely used .NET library that enables AJAX calls between web browsers and ASP.NET applications. The vulnerability stems from the library’s handling of serialized .NET objects in incoming HTTP requests. Because the deserialization process does not validate the data being processed, an attacker can craft a malicious payload that forces the server to instantiate arbitrary .NET classes.

The critical issue is not the library’s AJAX functionality, but its use of JavaScriptSerializer in a way that allows type inference from untrusted input. An attacker who can reach the AJAX endpoint can submit a serialized object that, when deserialized, triggers dangerous .NET gadgets. These gadgets can execute operating system commands, write files, or otherwise compromise the server with the privileges of the application pool.

The CVSS score of 9.8 reflects the severity: the attack requires no authentication, no user interaction, and can be launched over the network, though it does require some technical sophistication due to the high attack complexity. Successful exploitation gives the attacker complete control over the affected server.

Remediation

The original ajaxpro.2 package is no longer maintained and no patched version exists. Immediate action is required:

• Remove or replace ajaxpro.2: Migrate to a maintained fork or an alternative AJAX library for ASP.NET. The community fork “AjaxPro” on GitHub includes fixes for this vulnerability.
• Apply a WAF rule: If immediate removal is not possible, deploy a Web Application Firewall rule that blocks requests containing suspicious serialized .NET payloads bound for the AJAX handler.
• Restrict network access: Limit access to AJAX endpoints to trusted networks only, reducing the attack surface.
• Audit for compromise: Check affected servers for signs of post-exploitation activity, such as unexpected processes, new user accounts, or outbound connections to unfamiliar IPs.

For more context on recent exploitation campaigns, see the latest security news and review breach reports for indicators of compromise associated with this bug.

Security Insight

The persistence of CVE-2021-23758 in the KEV catalog despite its 2021 disclosure underscores a pattern: abandoned .NET libraries remain a silent liability in legacy applications. Unlike actively maintained frameworks where patches arrive within weeks, this vulnerability has no upstream fix, leaving every deployment permanently exposed. This mirrors the Log4j crisis - a ubiquitous library becomes a systemic risk when maintainers step away. Organizations must inventory third-party dependencies not just for known vulnerabilities, but for signs of project abandonment, and treat unmaintained components as technical debt that demands replacement, not monitoring.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs