TL;DR
CISA has listed CVE-2021-23758, a deserialization-of-untrusted-data flaw in Ajax.NET Professional (AjaxPro), in its Known Exploited Vulnerabilities catalog, confirming attackers are actively exploiting it. The flaw can permit remote code execution through arbitrary .NET classes and has no vendor patch, leaving remediation dependent on mitigations.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2021-23758, a deserialization of untrusted data vulnerability in Ajax.NET Professional (AjaxPro), to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are actively exploiting the flaw in the wild. The vulnerability can allow remote code execution on affected servers through the deserialization of attacker-controlled .NET classes, and because the library has no vendor-issued patch, organizations must rely on configuration changes and workarounds to protect exposed systems.
CVE-2021-23758 affects Ajax.NET Professional, also known as AjaxPro, a legacy .NET library historically used to add Ajax-style asynchronous functionality to ASP.NET web applications. According to the vulnerability record, the library deserializes untrusted data supplied in HTTP requests. When an application exposes an AjaxPro endpoint, an attacker can craft a request that causes the server to instantiate arbitrary .NET classes during deserialization. Security researchers have demonstrated that this behavior can be abused to achieve remote code execution on the underlying web server, typically with the privileges of the application pool identity running the site.
The vulnerability carries a CVSS base score of 9.8 (Critical), reflecting that exploitation can occur over the network, requires no authentication in exposed configurations, and can result in full system compromise. The flaw was publicly documented in late 2021, and proof-of-concept exploitation techniques have circulated since then, making any internet-facing AjaxPro endpoint a practical target.
Unlike most KEV entries, this vulnerability has no vendor security patch. AjaxPro is a long-obsolete library whose original development effectively ceased years ago, and no fixed version has been released. CISA’s KEV listing directs federal agencies and, by extension, other organizations to apply vendor-recommended mitigations where a patch does not exist. Documented mitigations include removing or disabling AjaxPro endpoints, blocking the library’s handler mappings at the web server or web application firewall level, and auditing for indicators that deserialization payloads have been submitted to affected applications.
Why CISA’s KEV Listing Raises Urgency
Inclusion in the Known Exploited Vulnerabilities catalog is a formal determination by CISA that a vulnerability is being exploited in the wild, and it carries regulatory weight. Under binding operational directives, federal civilian agencies are required to remediate KEV-listed vulnerabilities within specified timeframes, and CISA strongly recommends that private-sector organizations treat the catalog as a prioritization baseline for their own patching and mitigation programs.
The listing matters for a broader reason: AjaxPro is an end-of-life component embedded in many long-running enterprise and government web applications, some of which were built more than a decade ago and may not be actively maintained. Organizations may be unaware that legacy ASP.NET applications still contain AjaxPro endpoints, and automated vulnerability scanning of deprecated libraries is often incomplete. Where a patch does not exist, the only effective response is to remove the attack surface — a harder operational task than applying an update, because it requires locating and reworking affected code.
Successful exploitation of this class of flaw gives attackers code execution on web servers, which can be leveraged for data theft, deployment of web shells, credential harvesting, and lateral movement into internal networks. For internet-exposed systems, the KEV listing effectively signals that opportunistic scanning and exploitation are already underway.
As an affiliate, we earn on qualifying purchases.
AjaxPro’s History and the Deserialization Problem
Ajax.NET Professional was a popular third-party library in the mid-2000s that allowed ASP.NET developers to expose server-side .NET methods to JavaScript in the browser, before Microsoft shipped native Ajax support in ASP.NET AJAX. The library was widely embedded into applications and, in many cases, was never removed as platforms modernized. Its original author, Michael Schwarz, released the code under an open license, but active development ended years ago and no maintained version exists.
The vulnerability stems from how AjaxPro handles serialized data sent by clients. Rather than restricting deserialization to an allowlist of safe types, the library permits construction of arbitrary .NET classes from request data. This is a well-understood and repeatedly exploited pattern in the .NET ecosystem — comparable to earlier flaws in libraries such as Json.NET, ViewState, and other serializers — where attacker-supplied gadget chains turn deserialization into code execution. CVE-2021-23758 was assigned and publicly documented in late 2021, and exploitation tooling has been public since shortly thereafter, contributing to the scanning activity that preceded the KEV listing.
“The impacted product could be exploited to allow remote code execution via arbitrary .NET classes.”
— CISA, Known Exploited Vulnerabilities catalog entry
As an affiliate, we earn on qualifying purchases.
Unknowns About the Active Exploitation
While CISA’s KEV listing confirms that active exploitation is occurring, the agency has not disclosed details about the attacks themselves. It remains unclear which sectors or how many organizations have been targeted, whether exploitation is part of opportunistic mass scanning or of directed intrusion campaigns, and whether any ransomware or state-sponsored groups have used the flaw in specific incidents. No named victim organizations have been publicly confirmed in connection with CVE-2021-23758.
Estimating the number of exposed systems is also difficult. Because AjaxPro is compiled into individual applications rather than deployed as a standalone product, the true population of vulnerable endpoints is unknown and can only be approximated through internet-wide scanning for the library’s characteristic handler paths and response signatures.
firewall hardware for web application security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Finding and Fixing Vulnerable Endpoints
For federal agencies, the KEV listing starts a binding remediation clock, requiring action within CISA’s specified deadlines. For all other organizations, the immediate tasks are inventory and exposure reduction: searching source code and compiled binaries for the AjaxPro assembly and its HTTP handler references, testing whether legacy endpoints respond to AjaxPro-style requests, and removing or blocking those endpoints wherever they are found.
Organizations that cannot immediately remove AjaxPro should deploy compensating controls, including web application firewall rules that reject AjaxPro request patterns, restricting access to affected applications at the network layer, and reviewing web server logs for historical deserialization attempts that could indicate prior compromise. CISA is expected to publish further technical guidance if exploitation activity expands, and security researchers will likely continue to track scanning and exploitation trends for this endpoint pattern.
The Practice of Network Security Monitoring: Understanding Incident Detection and Response
- Condition: Used Book in Good Condition
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is CVE-2021-23758?
It is a deserialization of untrusted data vulnerability in the Ajax.NET Professional (AjaxPro) library. An attacker who can reach an exposed AjaxPro endpoint can send crafted data that instantiates arbitrary .NET classes, potentially achieving remote code execution on the server. It is rated CVSS 9.8 (Critical).
Is there a patch available?
No. AjaxPro is an unmaintained, end-of-life library and no vendor security patch has been released. Organizations must rely on mitigations such as removing AjaxPro endpoints, blocking the library’s handlers, or restricting access to affected applications.
Is the vulnerability being exploited right now?
Yes. By adding CVE-2021-23758 to its Known Exploited Vulnerabilities catalog, CISA confirmed that attackers are actively exploiting the flaw, though the agency has not detailed the specific campaigns or victims involved.
How can I tell if my application is affected?
Check application source code and deployed binaries for the AjaxPro assembly and its HTTP handler entries in web configuration files. Internet-facing endpoints that respond to AjaxPro request patterns are the highest-priority exposure.
What should organizations do if they cannot remove AjaxPro immediately?
Deploy compensating controls: web application firewall rules rejecting AjaxPro traffic, network-level access restrictions, and log review for deserialization attempts that could indicate prior compromise.
Source: kev
