CVE-2018-18325
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
Description
CVE-2018-18325 is a HIGH severity vulnerability in DotNetNuke (DNN) versions 9.2 through 9.2.2, classified under CWE-326 (Inadequate Encryption Strength). This vulnerability exists because of an incomplete fix for CVE-2018-15811, where DNN continued to use a weak encryption algorithm to protect input parameters even after the initial patch. With a CVSS 3.1 score of 7.5, the flaw allows remote unauthenticated attackers to decrypt protected parameters and chain the weakness with cookie deserialization to achieve remote code execution. CISA added CVE-2018-18325 to its KEV catalog on November 3, 2021. The EPSS score of 0.91084 (99.64th percentile) indicates an exceptionally high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dnnsoftware | dotnetnuke | >= 9.2, <= 9.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/dnnsoftware/Dnn.Platform/releases(Release Notes)
- https://www.dnnsoftware.com/community/security/security-center(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18325(US Government Resource)
Weakness Type
CWE-326: Inadequate Encryption Strength
Inadequate Encryption Strength occurs when software uses a cryptographic algorithm or key length that does not provide sufficient protection against decryption by an adversary. The software technically implements encryption, but the chosen algorithm, mode of operation, or key derivation is weak enough that attackers can break it using publicly known techniques. This category of weakness is particularly critical when it protects authentication mechanisms, session tokens, or serialized data that could be manipulated by an attacker after decryption.
In the context of CVE-2018-18325, the initial patch for CVE-2018-15811 did not fully resolve the weak encryption in DotNetNuke versions 9.2 through 9.2.2. The residual weakness meant that input parameters, including cookies containing serialized .NET objects, remained protected by encryption that could still be broken. Attackers exploiting this vulnerability can decrypt the protected parameters, modify them, re-encrypt the payload, and submit it back to the server. When DNN processes the tampered cookie, it deserializes the malicious payload, leading to remote code execution.
Learn more: CWE-326 — Inadequate Encryption Strength
Impact Analysis
CVE-2018-18325 carries a CVSS 3.1 base score of 7.5 (HIGH) with network-exploitable attack characteristics.
Confidentiality (High): The residual weak encryption allows unauthenticated remote attackers to decrypt protected input parameters. This exposes authentication tokens, session data, and serialized objects that are meant to be confidential. The exposure of these values provides the foundation for more severe attacks including remote code execution through deserialization.
Integrity (None): The CVSS vector indicates no direct integrity impact from the cryptographic weakness alone. However, once the encryption is broken, attackers can craft and encrypt malicious serialized payloads that, when deserialized by DNN, execute arbitrary code on the server, resulting in complete integrity compromise through the exploit chain.
Availability (None): No direct availability impact is indicated by the CVSS score. The vulnerability primarily enables information disclosure, though the downstream remote code execution capability can be used to disrupt service availability entirely.
Scope (Unchanged): The vulnerability is confined to the DNN application context. The EPSS score of 0.91084 (99.64th percentile) places this vulnerability in the top 0.4% of all CVEs for exploitation likelihood, consistent with the availability of public exploit code that targets both CVE-2018-15811 and CVE-2018-18325.
Exploit Maturity
Active Exploitation: CVE-2018-18325 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on November 3, 2021, with a mandatory remediation deadline of May 3, 2022 for federal agencies.
Public Exploits: The same exploit that targets CVE-2018-15811 is effective against CVE-2018-18325, as both vulnerabilities share the same root cause of weak encryption. The DotNetNuke Cookie Deserialization Remote Code Execution exploit on Packet Storm Security demonstrates the full attack chain from breaking the encryption to achieving code execution.
Incomplete Patch History: CVE-2018-18325 specifically addresses the fact that the original fix for CVE-2018-15811 was incomplete. DNN versions 9.2.2 remained vulnerable despite the initial patch, meaning organizations that applied the first fix still needed additional updates. This incomplete remediation history increases the risk that some installations remain unpatched.
EPSS Context: The EPSS score of 0.91084 (99.64th percentile) reflects the extremely high exploitation probability. The score is nearly identical to CVE-2018-15811, confirming that both vulnerabilities are equally targeted by threat actors.
KEV Deadline: Federal agencies were required to remediate by May 3, 2022. All organizations running DNN should verify they have applied the complete fix.
Remediation
-
Upgrade DotNetNuke to version 9.3.0 or later immediately. This version contains the complete fix for both CVE-2018-15811 and CVE-2018-18325. Download from the DNN Platform GitHub releases page. Do not rely on the partial fix in version 9.2.2.
-
Verify your current DNN version thoroughly. Check the DNN version number in the admin panel under Host Settings. Organizations that previously patched for CVE-2018-15811 may still be running version 9.2.2, which remains vulnerable to CVE-2018-18325.
-
Regenerate all cryptographic keys after upgrading. Reset the machine key and all encryption keys in the DNN configuration. Any tokens or cookies encrypted with the old weak algorithm could still be exploited by attackers who captured them before the upgrade.
-
Conduct a thorough security audit of the DNN installation. Review IIS logs for suspicious cookie manipulation, check for unauthorized file uploads or modifications, and look for evidence of deserialization attacks such as unexpected process execution under the IIS application pool identity.
-
Deploy intrusion detection rules for .NET deserialization attacks. Configure network-based and host-based IDS/IPS rules to detect common .NET deserialization payloads in HTTP cookies. Tools like ysoserial.net generate predictable patterns that can be signature-matched.
-
Consider migrating to the latest DNN major version. Running a DNN version that required multiple patches for the same vulnerability class suggests that a more comprehensive upgrade is warranted to benefit from architectural security improvements in newer releases.
Technical Details
CVE-2018-18325 is a cryptographic weakness in DotNetNuke (DNN) versions 9.2 through 9.2.2 that exists because the fix for CVE-2018-15811 was incomplete. DNN protects input parameters passed between client and server using encryption, and these parameters include cookies containing serialized .NET objects. The initial patch for CVE-2018-15811 attempted to strengthen the encryption but left a residual weakness that attackers could still exploit.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is identical to CVE-2018-15811, reflecting the same attack characteristics: remote exploitation over the network, low complexity, no authentication required, and high confidentiality impact. The vulnerability is exploitable without any user interaction.
The attack methodology is the same as for CVE-2018-15811. An attacker analyzes the encryption scheme used by the vulnerable DNN version, breaks the encryption to understand how cookie values are protected, and then crafts a malicious serialized .NET object. The attacker encrypts this payload using the weak algorithm and submits it as a cookie to the DNN application. When DNN receives the cookie, it decrypts the value and deserializes the contained object. Because the deserialization is unsafe, the attacker-controlled serialized object executes arbitrary code on the server.
The incomplete patch scenario is particularly concerning because organizations that diligently applied the first fix may have assumed they were protected. DNN version 9.2.2, which contained the partial fix for CVE-2018-15811, was still vulnerable to the same class of attack. Only versions 9.3.0 and later contain the complete remediation for the weak encryption issue.
The public exploit on Packet Storm Security works against both CVE-2018-15811 and CVE-2018-18325, as the underlying technique for breaking the encryption and exploiting deserialization applies to both vulnerable version ranges.
Frequently Asked Questions
Is CVE-2018-18325 being actively exploited?
Yes, CVE-2018-18325 is actively exploited in the wild. CISA confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog on November 3, 2021. The same public exploit that targets the related CVE-2018-15811 is effective against CVE-2018-18325, as both share the same weak encryption root cause.
What products are affected by CVE-2018-18325?
DotNetNuke (DNN) versions 9.2 through 9.2.2 are affected. This vulnerability is specifically notable because it represents an incomplete fix for CVE-2018-15811. Organizations that patched to version 9.2.2 thinking they were protected against the weak encryption issue remained vulnerable until upgrading to version 9.3.0 or later.
How do I fix CVE-2018-18325?
Upgrade DotNetNuke to version 9.3.0 or later, which contains the complete fix for both CVE-2018-15811 and CVE-2018-18325. After upgrading, regenerate all cryptographic keys and machine keys, review server logs for indicators of compromise, and consider deploying WAF rules to detect .NET deserialization attacks in cookies.
How severe is CVE-2018-18325?
CVE-2018-18325 is rated HIGH with a CVSS score of 7.5. Although classified as an information disclosure vulnerability through weak encryption, the real-world severity is much higher because the disclosed information enables remote code execution via unsafe cookie deserialization. The EPSS score of 0.91084 (99.64th percentile) places it in the top 0.4% of all CVEs for exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.