KnowledgeDeliver ViewState Deserialization RCE and BLUEBEAM Attack Analysis

Vulnerability Overview Vulnerability Name: ViewState Deserialization Vulnerability Vulnerability Description: This vulnerability allows unauthorized remote code execution (RCE). Attackers can exploit identical pre-shared ASP.NET machine keys to inject malicious code into the LMS platform across multiple customer deployments. Vulnerability Cause: KnowledgeDeliver installations prior to February 24, 2026, relied on a standardized web.config file provided by the vendor, which contained hardcoded machineKey values. These keys were identical across independent customer environments, enabling attackers to obtain the key from one deployment and use it in others. Impact Scope Affected Systems: KnowledgeDeliver installations deployed before February 24, 2026. Attack Method: Attackers send HTTP requests containing malicious ViewState payloads, causing the server to deserialize the payload and execute arbitrary code. Subsequent Activities: Attackers deployed BLUEBEAM Web Shells, modified file permissions, injected malicious JavaScript, and established further control through Cobalt Strike BEACON backdoors. Remediation Measures Immediate Actions: Generate unique, cryptographically strong machineKey values for each KnowledgeDeliver instance. Access Restrictions: If possible, restrict access to the LMS to only known organizational IP address ranges. Investigation: Monitor and investigate any suspected signs of exploitation, conducting a thorough investigation. Exploit Code Additional Information Relevant Event Logs: Monitor Windows Application Logs for Event ID 1316, especially error codes related to ViewState validation failures. Suspicious Process Activity: Monitor for abnormal child processes spawned by w3wp.exe, such as cmd.exe, whoami, or powershell.exe. File Integrity Monitoring: Monitor for unauthorized changes to .js, .aspx, or .config files. Anomalous User Agent Strings: Monitor for user agent strings containing specific identifiers associated with known ViewState deserialization vulnerabilities. Indicators of Compromise (IOCs) File Name: LoadLibrary.dll Type: BLUEBEAM SHA-256: 7c1f99dca8e5a7b97892f9d224a6495023a2 Summary This vulnerability allows unauthorized remote code execution by exploiting identical pre-shared ASP.NET machine keys. Attackers send malicious ViewState payloads, causing the server to deserialize and execute arbitrary code. Remediation includes generating unique machineKey values, restricting access, and conducting a thorough investigation.

Goal Reached Thanks to every supporter — we hit 100%!

KnowledgeDeliver ViewState Deserialization RCE and BLUEBEAM Attack Analysis