CVE-2017-9822
DotNetNuke (DNN) Remote Code Execution Vulnerability
Description
CVE-2017-9822 is a HIGH severity remote code execution vulnerability in DotNetNuke (DNN) versions before 9.1.1, classified under CWE-94 (Improper Control of Generation of Code). The flaw allows authenticated attackers to execute arbitrary code on the server through cookie deserialization. With a CVSS 3.1 score of 8.8, a low-privileged user can exploit this vulnerability to gain complete control over the DNN web application and underlying server. CISA added CVE-2017-9822 to its KEV catalog on November 3, 2021, and it has confirmed associations with ransomware campaigns. The EPSS score of 0.94293 (99.94th percentile) indicates an exceptionally high probability of exploitation, placing it among the most actively targeted vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dnnsoftware | dotnetnuke | < 9.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.dnnsoftware.com/community/security/security-center(Product, Vendor Advisory)
- http://www.securityfocus.com/bid/102213(Broken Link, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9822(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code, commonly known as code injection, occurs when software constructs code segments using externally-influenced input without properly neutralizing or validating that input. This allows an attacker to alter the intended code execution by injecting malicious code that the application then executes with its own privileges. Unlike command injection (CWE-78), code injection targets the application's own programming language runtime, making detection and prevention more nuanced.
In the context of CVE-2017-9822, DotNetNuke before version 9.1.1 deserializes .NET objects from cookie values without adequate validation. An authenticated attacker can craft a malicious serialized .NET object containing code injection payloads and submit it as a cookie. When DNN processes the cookie, it deserializes the object, triggering the execution of attacker-controlled code within the DNN application context. Because the DNN application typically runs with elevated web server privileges, the injected code can access the filesystem, execute system commands, and compromise the entire server.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2017-9822 carries a CVSS 3.1 base score of 8.8 (HIGH) with network-exploitable attack characteristics requiring low privileges.
Confidentiality (High): Successful exploitation allows the attacker to execute arbitrary code on the DNN server. This provides access to the entire web application database including user credentials, personal data, content, and configuration files. The attacker can also access the underlying server filesystem, potentially exposing database connection strings, API keys, and other sensitive configuration data stored on the host.
Integrity (High): With code execution on the server, the attacker can modify any aspect of the DNN installation including website content, user accounts, administrative configurations, and installed modules. The attacker can also install backdoors, web shells, and persistent malware that survives application updates. Given the ransomware association, attackers have used this access to deploy ransomware payloads that encrypt server data.
Availability (High): The attacker can disrupt the entire DNN web application and potentially the underlying server. Ransomware deployments leveraging this vulnerability have caused complete service outages by encrypting application files and databases. The attacker can also consume server resources, delete critical files, or modify configurations to render the application inoperable.
Scope (Unchanged): The scope remains within the DNN application and its host server context. The EPSS score of 0.94293 (99.94th percentile) places this in the top 0.06% of all CVEs, reflecting extremely high real-world exploitation activity amplified by the ransomware association.
Exploit Maturity
Active Exploitation: CVE-2017-9822 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on November 3, 2021, with a mandatory remediation deadline of May 3, 2022 for federal agencies.
Ransomware Association: CISA's KEV catalog explicitly confirms that CVE-2017-9822 is associated with known ransomware campaigns. Ransomware operators exploit this vulnerability to gain initial code execution on DNN servers, which they then leverage to deploy ransomware payloads that encrypt the server's data and demand ransom payments.
Public Exploits: A complete exploit for DotNetNuke cookie deserialization leading to remote code execution is publicly available on Packet Storm Security. This exploit demonstrates the full attack chain from crafting malicious serialized objects to achieving code execution.
EPSS Context: The EPSS score of 0.94293 (99.94th percentile) places this vulnerability in the top 0.06% of all CVEs for exploitation probability. This exceptionally high score reflects the combination of public exploit availability, confirmed ransomware usage, and the large number of DNN installations accessible on the internet.
KEV Deadline: Federal agencies were required to apply remediation by May 3, 2022. Given the ransomware association, all organizations running DNN should treat this as a critical priority regardless of sector.
Remediation
-
Upgrade DotNetNuke to version 9.1.1 or later immediately. The patch corrects the unsafe cookie deserialization that enables remote code execution. Download from the DNN Platform GitHub releases. Given the ransomware association, this should be treated as an emergency patch.
-
Also patch for CVE-2018-15811 and CVE-2018-18325. Later DNN versions introduced a related weak encryption vulnerability that was exploited in conjunction with deserialization attacks. Upgrade to at least DNN 9.3.0 to address all three related vulnerabilities comprehensively.
-
Scan for indicators of compromise immediately. Check for web shells in the DNN installation directory, especially in writable folders like Portals and App_Data. Look for suspicious processes spawned by the IIS worker process (w3wp.exe), unexpected scheduled tasks, and new user accounts with administrative privileges.
-
Invalidate all existing sessions and authentication tokens. Force all users to re-authenticate after applying the patch. Regenerate the machine key to ensure that any previously crafted malicious cookies are no longer valid.
-
Implement network-level protection. Deploy a web application firewall with rules to detect .NET deserialization payloads in HTTP cookies. Restrict access to the DNN installation from the internet if possible, using VPN or IP whitelisting for administrative access.
-
Prepare an incident response plan for ransomware. Given the confirmed ransomware association, ensure offline backups of the DNN database and file system exist. Test restoration procedures and have a documented incident response plan ready in case exploitation has already occurred.
Technical Details
CVE-2017-9822 is a remote code execution vulnerability in DotNetNuke (DNN) versions before 9.1.1 that exploits unsafe deserialization of .NET objects from cookie values. DNN stores serialized .NET objects in cookies to maintain state between requests, and the application deserializes these objects on the server side without adequate safety controls.
The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-based with low complexity and requires only low-level authentication. This means any registered user on a DNN site can potentially exploit the vulnerability, significantly expanding the pool of potential attackers compared to vulnerabilities requiring administrative access.
The attack works by crafting a malicious serialized .NET object using tools such as ysoserial.net. The attacker creates a payload that, when deserialized, executes arbitrary operating system commands or .NET code. This serialized payload is then placed in a DNN cookie and sent to the server. When DNN processes the request and deserializes the cookie, the malicious object's code is executed with the privileges of the IIS application pool running the DNN site.
The vulnerability is particularly dangerous because DNN is a widely deployed web content management system, and many installations are directly accessible from the internet. The low privilege requirement means that even a basic registered user account is sufficient to launch the attack. In scenarios where DNN allows self-registration, an attacker can create their own account and immediately exploit the vulnerability.
The confirmed ransomware association indicates that threat actors have developed automated exploitation workflows that chain initial access, privilege escalation, and ransomware deployment through this single vulnerability. The exploit on Packet Storm Security provides the technical foundation that makes this automation possible.
Frequently Asked Questions
Is CVE-2017-9822 being actively exploited?
Yes, CVE-2017-9822 is actively exploited in the wild and has confirmed associations with ransomware campaigns. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. The EPSS score of 0.94293 (99.94th percentile) places it in the top 0.06% of all CVEs for exploitation probability, making it one of the most actively targeted vulnerabilities.
What products are affected by CVE-2017-9822?
DotNetNuke (DNN) versions before 9.1.1 are affected. DNN is an open-source web content management system built on the Microsoft .NET framework. Any DNN website running a version older than 9.1.1 is vulnerable to remote code execution through cookie deserialization. Organizations should also ensure they have patched for the related CVE-2018-15811 and CVE-2018-18325.
How do I fix CVE-2017-9822?
Upgrade DotNetNuke to version 9.3.0 or later to address CVE-2017-9822 along with the related CVE-2018-15811 and CVE-2018-18325. After upgrading, regenerate the machine key, invalidate all sessions, scan for web shells and indicators of compromise, and review server logs for evidence of exploitation. Given the ransomware association, ensure current offline backups exist before beginning remediation.
How severe is CVE-2017-9822?
CVE-2017-9822 is rated HIGH with a CVSS score of 8.8 and has confirmed ransomware associations. The vulnerability allows authenticated attackers to execute arbitrary code on the server through cookie deserialization, leading to complete server compromise. The EPSS score of 0.94293 (99.94th percentile) reflects the extremely high exploitation activity. The combination of public exploit availability, ransomware usage, and wide DNN deployment makes this one of the most dangerous DNN vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.