CVE-2025-52488 Scanner

DNN (DotNetNuke) is a popular open-source content management system (CMS) built on the Microsoft .NET framework. It is widely used by enterprises, educational institutions, and small to medium businesses to create, manage, and deploy dynamic websites and web applications. DNN offers a modular architecture with extensive customization options, making it a flexible platform for various web development needs. Its user-friendly interface and robust feature set enable organizations to efficiently manage content, users, and permissions.

CVE-2025-52488 is an information disclosure vulnerability that arises from improper handling of Unicode path normalization in DNN. The flaw occurs when the application processes file paths containing Unicode characters, which can be manipulated to bypass security checks. This allows an attacker to force the server to initiate an outbound SMB connection to an external server under their control, thereby exposing NTLM hashes. The vulnerability is critical because NTLM hashes can be used in pass-the-hash attacks or cracked offline to reveal plaintext passwords.

Specifically, the vulnerability is triggered through the file upload or file management endpoints in DNN, where user-supplied paths are not properly sanitized for Unicode normalization. By crafting a malicious request with specially encoded Unicode characters, an attacker can cause the server to interpret the path as pointing to an external SMB share. This results in the server automatically sending its NTLM authentication challenge to the attacker's SMB server, leaking the hash. The affected versions range from 6.0.0 to before 10.0.1.

If successfully exploited, an attacker can obtain NTLM hashes of the DNN server's service account or the user account running the application. These hashes can then be used to authenticate to other network resources, potentially leading to lateral movement and privilege escalation within the organization's network. The high CVSS score of 8.6 reflects the ease of exploitation and the severe impact on confidentiality and integrity. Organizations using affected versions are at risk of credential theft and subsequent network compromise.