CVE-2025-52488
HIGH
GHSA-mgfv-2362-jq96
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
Analysis
DNN (DotNetNuke) CMS versions 6.0.0 through 10.0.0 contain a vulnerability that can expose NTLM hashes to a third-party SMB server. Through a specially crafted series of interactions, an attacker can force the DNN server to authenticate to an attacker-controlled SMB server, capturing NTLM credential hashes for offline cracking.
Technical Context
The vulnerability allows an attacker to trigger the DNN server to make an outbound SMB connection to an attacker-controlled server. Windows automatically sends NTLM authentication credentials during SMB connections. The attacker captures the NTLMv2 hash and cracks it offline using tools like hashcat, recovering the service account's plaintext password.
Affected Products
['DNN 6.0.0 through 10.0.0', 'DotNetNuke']
Remediation
Update to DNN 10.0.1 or later. Block outbound SMB (port 445) from web servers. Use a local service account (not domain account) for the IIS application pool. Implement SMB signing.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today