Remote Code Execution in DotNetNuke (DNN) via Cookie Deserialization (CVE‑2017‑9822)
What It Is — DotNetNuke (DNN) contains a remote‑code‑execution flaw that can be triggered when a maliciously crafted authentication cookie is deserialized on the server. Successful exploitation gives an attacker the ability to run arbitrary code in the context of the web application.
Exploitability — Public proof‑of‑concept code is available; the vulnerability carries a CVSS 3.1 base score of 9.8 (Critical). A vendor‑issued patch was released in early 2018, but many installations remain unpatched.
Affected Products — All DNN versions released before the 2018 security update (pre‑v7.3.4) are vulnerable.
Why It Matters for Trust & Control Assurance
- Secure deserialization is a core control; a gap here signals weak application‑level safeguards that auditors will scrutinize.
- Continuous monitoring of third‑party components (e.g., CMS platforms) provides the evidence needed to demonstrate due‑diligence in vulnerability management.
- Timely patch application and documented remediation steps become defensible audit artifacts that support a robust trust posture.
Recommended Actions
- Deploy the official DNN security patch immediately.
- Review cookie handling code; enforce strict input validation or adopt a safe‑deserialization library.
- Update your asset inventory to flag DNN instances and enable continuous vulnerability scanning for those assets.
- Log and retain evidence of patch deployment for audit readiness.
Source: CISA KEV – CVE‑2017‑9822