Security analysts at the Mandiant Threat Defense team have disrupted an attack exploiting a zero-day vulnerability in Sitecore, a popular content management system (CMS) used by companies such as HSBC, L’Oréal, Toyota and United Airlines. In a report published on September 3, Mandiant, part of Google Cloud, said that the attack leveraged exposed ASP.NET machine keys in Sitecore deployment guides from 2017 and earlier to perform remote code execution (RCE). ASP.NET is a web application framework developed by Microsoft for building dynamic websites, web apps and application programming interfaces (APIs). ASP.NET machine keys are cryptographic keys used to secure critical operations in ASP.NET applications. These machine keys were exposed because of a ViewState deserialization vulnerability…