CVE-2017-9822
Published: 20 July 2017
Summary
CVE-2017-9822 is a high-severity Code Injection (CWE-94) vulnerability in Dnnsoftware Dotnetnuke. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
DNN (also known as DotNetNuke) versions prior to 9.1.1 contain a remote code execution vulnerability that can be triggered through a specially crafted cookie. The issue is tracked as CVE-2017-9822 with a CVSS v3.1 score of 8.8 and is associated with CWE-94, indicating improper control of code generation. The flaw affects the web application platform when processing serialized data supplied in HTTP cookies.
An attacker with low-privileged network access and no user interaction required can supply a malicious cookie that leads to arbitrary code execution on the server. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the affected DNN site.
Public references point to the official DNN security center for advisories and to exploit artifacts demonstrating cookie-based deserialization attacks. Upgrading to version 9.1.1 or later is indicated as the corrective action in the vulnerability description. Public exploit code has been published, confirming that working proof-of-concept material exists for this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-0710
Vulnerability details
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of untrusted serialized data supplied in HTTP cookies before deserialization occurs.
Requires prompt application of the vendor-supplied patch (upgrade to DNN 9.1.1+) that eliminates the unsafe deserialization path.
Provides integrity verification of executing code and can detect unauthorized code introduced via the cookie-based deserialization attack.