Dotnetnuke < 10.3.3 Portal administrator remote code execution (GHSA-hxc3-xv8x-w2g3)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339644);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_name(english:"Dotnetnuke < 10.3.3 Portal administrator remote code execution (GHSA-hxc3-xv8x-w2g3)");

  script_set_attribute(attribute:"synopsis", value:
"An ASP.NET application running on the remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3.
It is, therefore, affected by a vulnerability.

  - A vulnerability could allow a Portal Administrator to execute arbitrary code on the DNN server under
    certain deployment configurations. A vulnerability was identified in the platform's theme management
    functionality where administrator-supplied content was not safely validated before being incorporated into
    server-side resources. Under certain deployment configurations, a Portal Administrator could exploit this
    issue to execute arbitrary code on the server with the privileges of the DNN application. Successful
    exploitation could lead to complete compromise of the affected DNN installation, including unauthorized
    access to application data, uploaded files, configuration settings, and other resources available to the
    application. The impact is particularly significant for multi-portal deployments, where a Portal
    Administrator for a single portal could potentially compromise the entire DNN installation, including
    other portals hosted on the same instance. Depending on the hosting environment security settings and
    application permissions, exploitation may also provide access to external resources or services available
    to the server. (GHSA-hxc3-xv8x-w2g3)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-hxc3-xv8x-w2g3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?44379cc4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Dotnetnuke version 10.3.3 or later.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(94);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dotnetnuke:dotnetnuke");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dnnsoftware:dotnetnuke");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dotnetnuke_detect.nasl");
  script_require_keys("installed_sw/DNN");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'DNN';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:80, asp:TRUE);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'fixed_version' : '10.3.3' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);