Remote Code Execution via Deserialization in Ajax.NET Professional (CVE‑2021‑23758)
What It Is — Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data flaw that can lead to remote code execution by supplying crafted .NET objects. The vulnerability is tracked as CVE‑2021‑23758.
Exploitability — Publicly disclosed; proof‑of‑concept code exists. CVSS v3.1 score 9.8 (Critical) indicating a high likelihood of remote exploitation.
Affected Products — Ajax.NET Professional library (including end‑of‑life or end‑of‑service versions).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of third‑party components to prove due‑diligence in supply‑chain risk.
- Directly tests the control objective of secure software development and component integrity across frameworks.
- Provides audit‑ready evidence that your organization tracks, patches, or retires vulnerable libraries.
Recommended Actions
- Inventory all applications that embed Ajax.NET Professional and verify the version in use.
- Apply any available patches or migrate to a supported alternative immediately.
- Record remediation steps in your control‑evidence repository to satisfy audit requirements.
Source: CISA KEV – CVE‑2021‑23758