DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) versions before 9.1.1 contain a flaw in how the platform handles cookie input, which can lead to improper control of code generation and improper input validation. An attacker with network access and low-privilege authenticated access to the application can exploit this without any user interaction to achieve remote code execution.
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
First seen exploited 4 years after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in DotNetNuke.Core over 4 years. The latest fix listed for DotNetNuke.Core is 9.2.2.
CVE-2017-9822 is a vulnerability allows an attacker to exploit cookie deserialization, leading to remote code execution (RCE). It has been noted for its potential impact on various web applications
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: DotNetNuke.Core.
Upgrade to 9.3.0 or later
Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2015-2794, CVE-2017-0929, +3).
Set the version to 9.3.0 or later in your .csproj.
First fixed in 9.1.1 for CVE-2017-9822.
| If you run | Upgrade to |
|---|---|
| All versions before 9.1.1 | 9.3.0first fix for this CVE: 9.1.1 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.