Dotnetnuke < 10.3.3 Optional JavaScript restrictions for HTML module content (GHSA-mjq6-87j6-5f4g)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339554);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_name(english:"Dotnetnuke < 10.3.3 Optional JavaScript restrictions for HTML module content (GHSA-mjq6-87j6-5f4g)");

  script_set_attribute(attribute:"synopsis", value:
"An ASP.NET application running on the remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3.
It is, therefore, affected by a vulnerability.

  - The HTML module historically allowed trusted content editors to include JavaScript within HTML content. A
    new security option has been added to allow administrators to prevent executable scripts from being stored
    in HTML module content, reducing the risk of cross-site scripting (XSS) in environments where content
    editors are not fully trusted. The HTML module has traditionally permitted users with content editing
    permissions to create rich HTML content, including JavaScript. While this behavior is expected in many
    deployments where content editors are trusted, it may present a security risk in environments where
    content editing permissions are delegated to users who should not be permitted to execute client-side
    code. To improve deployment flexibility, DNN now includes an option to disallow JavaScript within HTML
    module content. New installations enable this protection by default. Existing installations retain their
    current behavior to preserve compatibility, but administrators are encouraged to evaluate enabling the new
    setting if content editors are not intended to publish executable scripts. This enhancement provides an
    additional layer of defense against cross-site scripting (XSS) while allowing administrators to choose the
    behavior that best fits their site's trust model. (GHSA-mjq6-87j6-5f4g)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mjq6-87j6-5f4g
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ee0fb6a6");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Dotnetnuke version 10.3.3 or later.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dotnetnuke:dotnetnuke");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dnnsoftware:dotnetnuke");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dotnetnuke_detect.nasl");
  script_require_keys("installed_sw/DNN");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'DNN';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:80, asp:TRUE);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'fixed_version' : '10.3.3' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);