Dotnetnuke < 10.3.3 Content approval workflow bypass (GHSA-56m6-r25g-78x6)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339498);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/25");

  script_name(english:"Dotnetnuke < 10.3.3 Content approval workflow bypass (GHSA-56m6-r25g-78x6)");

  script_set_attribute(attribute:"synopsis", value:
"An ASP.NET application running on the remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3.
It is, therefore, affected by a vulnerability.

  - A vulnerability in the content workflow could allow a user with content editing permissions to publish
    their own changes without the required approval process. Sites using content approval workflows should
    upgrade to a patched release to ensure workflow approval requirements are consistently enforced. A
    vulnerability was identified in the platform's content workflow where workflow authorization was not
    consistently enforced during state transitions. Under certain conditions, a user with permission to create
    or edit content could bypass the configured approval process and publish their own changes without review
    by an authorized approver. Successful exploitation could undermine the integrity of content approval
    workflows by allowing unreviewed content to be published, defeating organizational controls designed to
    ensure editorial oversight, compliance, or change management before content becomes publicly visible.
    (GHSA-56m6-r25g-78x6)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-56m6-r25g-78x6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8b95e37f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Dotnetnuke version 10.3.3 or later.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dotnetnuke:dotnetnuke");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dnnsoftware:dotnetnuke");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dotnetnuke_detect.nasl");
  script_require_keys("installed_sw/DNN");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'DNN';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:80, asp:TRUE);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'fixed_version' : '10.3.3' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);