DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible
    remote code execution on DNN sites." (CVE-2017-9822)

DotNetNuke CMS versions 5.0.0 to 9.1.0 are affected by an insecure deserialization vulnerability that leads to Remote Code Execution (RCE). DotNetNuke uses the DNNPersonalization cookie to store anonymous users personalization options. This cookie is used when the application serves a custom 404 Error page, which is the default settings.

The version of DNN Platform (formerly DotNetNuke) running on the remote host is 5.2.0 or later but prior to 9.1.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     insecure use of web cookies to identify users. An     unauthenticated, remote attacker can exploit this, by     impersonating a user and uploading malicious code to the     server, to execute arbitrary code. This vulnerability     affects all versions from 7.0.0 to 9.1.0.

  - A flaw exists due to an overly permissive HTML5 message     posting policy when handling cross-document messaging.
    An unauthenticated, remote attacker can exploit this to     conduct a spoofing attack or to disclose sensitive     information. This vulnerability affects all versions     from 8.0.0 to 9.1.0.

  - A cross-site redirection vulnerability exists due to     improper validation of user-supplied input before     returning it to users. An unauthenticated, remote     attacker can exploit this, by convincing a user to     follow a specially crafted link, to redirect users to a     website of the attacker's choosing. This vulnerability     affects all versions from 7.0.0 to 9.1.0.

  - A remote code execution vulnerability exists due to a     failure to properly validate file types and extensions     for uploaded files before placing them in a     user-accessible path. An authenticated, remote attacker     can exploit this to execute arbitrary code with the     privileges of the web service. This vulnerability     affects all versions from 5.2.0 to 9.1.0.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
421974	SCA: security update for DotNetNuke.Core (GHSA-x2rg-fmcv-crq5)	Tenable Cloud Security	SCA Checks	Local	high
421974	SCA: security update for DotNetNuke.Core (GHSA-x2rg-fmcv-crq5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
113335	DotNetNuke 5.x < 9.1.1 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	high
101397	DNN (DotNetNuke) 5.2.0 < 9.1.1 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2017-9822

high

Tenable Plugins

high

high

high

high