CVE-2025-32373

Executive Summary

CVE-2025-32373 is an authorization bypass vulnerability in DNN (formerly DotNetNuke), an open-source web content management platform for the Microsoft ecosystem. In specific configurations, a registered user can craft a malicious request to enumerate or access portal files that should be restricted. The vulnerability has a CVSS score of 6.5 (Medium) and is fixed in version 9.13.8. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. This report provides a comprehensive technical analysis, detection guidance, and remediation steps.

Supply Chain & Package Security

DNN is distributed as a NuGet package and a web application installer. Organizations using DNN should verify their version and update to 9.13.8 or later. The vulnerability does not affect the package supply chain directly, but outdated installations are at risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (registered user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (file enumeration/access)
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the requirement of a registered user account and the limited impact to confidentiality only. However, in environments with sensitive portal files, the risk is elevated.

Deep Dive & Mechanics

The vulnerability resides in DNN's file access control logic. In limited configurations (e.g., when portal-level permissions are misconfigured or when using specific file providers), the authorization check for file enumeration and access can be bypassed by a registered user. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

Root Cause: The application fails to properly validate that the requesting user has the necessary permissions for the target portal file. By manipulating request parameters (such as file IDs, portal IDs, or file paths), an attacker can enumerate files belonging to other portals or access files with higher privilege requirements.

Attack Scenario:

1. An attacker registers a standard user account on a DNN instance.
2. The attacker crafts a GET request to a file handler endpoint (e.g., /FileDownload.ashx or /LinkClick.aspx) with manipulated parameters (e.g., PortalID, FileID, or FilePath).
3. The server processes the request without verifying the user's permissions for the target file, returning the file content or metadata.
4. The attacker can iterate through file IDs to enumerate all accessible files across portals.

Vulnerable vs. Patched Code

The fix in version 9.13.8 adds an authorization check before serving file requests. Below is a conceptual comparison.

Vulnerable Code (Simplified):

public void ProcessRequest(HttpContext context)
{
    int fileId = int.Parse(context.Request["FileID"]);
    int portalId = int.Parse(context.Request["PortalID"]);
    // No permission check
    var file = FileController.GetFileById(fileId, portalId);
    if (file != null)
    {
        // Serve file
        context.Response.WriteFile(file.PhysicalPath);
    }
}

Patched Code (Simplified):

public void ProcessRequest(HttpContext context)
{
    int fileId = int.Parse(context.Request["FileID"]);
    int portalId = int.Parse(context.Request["PortalID"]);
    var user = HttpContext.Current.User;
    // Authorization check
    if (!FilePermissionController.CanViewFile(fileId, portalId, user))
    {
        context.Response.StatusCode = 403;
        return;
    }
    var file = FileController.GetFileById(fileId, portalId);
    if (file != null)
    {
        context.Response.WriteFile(file.PhysicalPath);
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A DNN instance running version < 9.13.8.
• A registered user account (any role).

Exploitation Steps:

1. Log in to the DNN site as a registered user.
2. Identify file download endpoints (e.g., /FileDownload.ashx, /LinkClick.aspx, or /DocumentDownload.ashx).
3. Craft a request to enumerate files by manipulating parameters:

   GET /FileDownload.ashx?FileID=1&PortalID=0 HTTP/1.1
   Host: target-dnn-site.com
   Cookie: .DNNUser=...
   

4. Iterate FileID values (e.g., 1, 2, 3...) to discover files from other portals.
5. For file access, use the same technique to download files that should be restricted.

Example cURL command:

curl -b ".DNNUser=your_session_cookie" "http://target/FileDownload.ashx?FileID=5&PortalID=1" -o output.file

Blue Team (Defensive)

Detection:

• Monitor for unusual patterns in file download requests, especially from low-privilege users.
• Look for sequential FileID or PortalID values in logs.
• Alert on 403 errors followed by repeated attempts.

Honeypot:

• Deploy a fake file endpoint that logs all requests and triggers an alert when accessed with suspicious parameters.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /FileDownload.ashx, /LinkClick.aspx, or similar endpoints with multiple FileID or PortalID parameters from a single user.
  • Sequential FileID values in logs (e.g., 1, 2, 3, 4...).
• Logs:
  • DNN event log entries showing file access attempts from users without proper permissions.
  • Repeated 403 errors followed by successful 200 responses for file downloads.
• System:
  • Unauthorized file downloads in web server logs.

Detection Engineering

YARA Rule

rule CVE_2025_32373_DNN_FileEnumeration {
    meta:
        description = "Detects attempts to exploit CVE-2025-32373 in DNN"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-32373"
    strings:
        $s1 = "FileDownload.ashx" nocase
        $s2 = "LinkClick.aspx" nocase
        $s3 = "DocumentDownload.ashx" nocase
        $s4 = "FileID=" nocase
        $s5 = "PortalID=" nocase
    condition:
        any of ($s1, $s2, $s3) and all of ($s4, $s5)
}

Sigma Rule

title: DNN File Enumeration via CVE-2025-32373
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-32373 in DNN CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "FileDownload.ashx"
            - "LinkClick.aspx"
            - "DocumentDownload.ashx"
        cs-uri-query|contains|all:
            - "FileID="
            - "PortalID="
    condition: selection
falsepositives:
    - Legitimate file access by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-32373 DNN File Enumeration Attempt";
    flow:to_server,established;
    content:"FileDownload.ashx"; http_uri; nocase;
    content:"FileID="; http_uri; nocase;
    content:"PortalID="; http_uri; nocase;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade DNN to version 9.13.8 or later.
2. If upgrade is not possible, restrict file download endpoints to authenticated users with proper roles via web.config or IIS URL Authorization.

Long-term:

• Implement strict authorization checks for all file access endpoints.
• Conduct a security review of custom modules that handle file downloads.
• Monitor logs for unusual file access patterns.

Workaround:

• Disable file download endpoints for unauthenticated users and restrict to specific roles using IIS URL Rewrite or custom HTTP modules.

Valters IT