Dotnetnuke < 10.3.3 User registration approval authorization bypass (GHSA-fpr5-67pq-3hf5)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339646);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_name(english:"Dotnetnuke < 10.3.3 User registration approval authorization bypass (GHSA-fpr5-67pq-3hf5)");

  script_set_attribute(attribute:"synopsis", value:
"An ASP.NET application running on the remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3.
It is, therefore, affected by a vulnerability.

  - An authorization vulnerability could allow an authenticated user to approve pending user registrations
    without administrative privileges. Sites using administrator approval for new user registrations should
    upgrade immediately to ensure registration approval actions are properly restricted. A vulnerability was
    identified in the platform's user registration approval process where authorization checks were not
    consistently enforced before approving pending user accounts. Under certain conditions, an authenticated
    user with minimal privileges could perform registration approval actions that should be restricted to
    authorized administrators. Successful exploitation could bypass administrative review of new user
    registrations, allowing pending accounts to become active without the intended approval process. This
    undermines the integrity of moderated registration workflows and may allow unauthorized or self-approved
    accounts to gain access to the site. The impact is particularly significant for sites that rely on
    administrator approval as a security control, such as private communities, intranets, customer portals, or
    regulated environments where account approval is used to verify identity, eligibility, or organizational
    affiliation before granting access. In these environments, successful exploitation could allow
    unauthorized users to obtain access to protected content or functionality that would otherwise require
    administrative approval. (GHSA-fpr5-67pq-3hf5)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpr5-67pq-3hf5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7142c4a8");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Dotnetnuke version 10.3.3 or later.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(639);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dotnetnuke:dotnetnuke");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dnnsoftware:dotnetnuke");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dotnetnuke_detect.nasl");
  script_require_keys("installed_sw/DNN");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'DNN';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:80, asp:TRUE);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'fixed_version' : '10.3.3' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);