A high-severity denial of service vulnerability in Kentico Xperience allows unauthenticated remote attackers to crash systems by sending malicious requests to the GetResource handler.

This vulnerability is caused by improper input validation within the GetResource handler, classified as CWE-97. The flaw allows an unauthenticated attacker to trigger a denial of service state by submitting specially crafted requests to the application.

The exploitation of this vulnerability results in the disruption of critical business web services, leading to potential system downtime and loss of availability for end users. With a CVSS score of 7.5, the risk is considered high due to the ease of exploitation, as it requires no prior authentication or user interaction to execute.

Immediate Action: Review the official Kentico devnet hotfix portal to identify and apply the necessary security updates for your specific version of Xperience.

Proactive Monitoring: Monitor server access logs for unusual patterns of traffic directed specifically at the GetResource handler and investigate spikes in resource consumption.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malformed requests targeting the GetResource handler to reduce the attack surface.

Public Exploit Available: No

Given the ease of exploitation and the potential for significant service disruption, organizations running versions of Kentico Xperience up to 12.0.98 should prioritize applying the vendor-provided hotfixes. If an immediate patch cannot be deployed, implement strict WAF filtering to protect the vulnerable handler from malicious traffic until the software can be updated.