DotNetNuke (DNN) Remote Code Execution Vulnerability (CVE-2017-9822)

What is affected, what to do

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update dotnetnuke to version 9.1.1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• DotNetNuke CMS Fixed in 9.1.1 eq DotNetNuke CMS Fixed in 9.1.1..DotNetNuke CMS Fixed in 9.1.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every DNN/DotNetNuke instance, including legacy microsites, agency-hosted sites and staging. Check the version via /Install/Version.txt, the admin UI or the assembly version of DotNetNuke.dll in bin. Anything before 9.1.1 is vulnerable, including NuGet dotnetnuke.core 6.0.0 through 7.2.x.
   • Patch: Upgrade to at least DNN 9.1.1. Further deserialization bypasses of the 9.1.1 fix were disclosed later, so go straight to the currently supported DNN Platform release. Look up the exact version in the vendor advisory. Back up the database and file system first.
   • Isolate unpatchable instances: Take instances you cannot patch quickly off the internet. Alternatively, front them with a reverse proxy that strips the DNNPersonalization cookie (see Mitigation).
   • Hunt before you patch: Sweep the web root for new or modified .aspx, .ashx and .asmx files, especially under /Portals/ and /DesktopModules/. Treat any webshell as an incident: image the host rather than just cleaning it.
   • Rotate secrets on suspicion: Regenerate the machineKey (validationKey/decryptionKey) in web.config. Change the SQL credentials in the connection string. Reset the DNN host and admin account passwords.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF/reverse proxy: Strip the DNNPersonalization cookie at the edge, or block requests where its value contains XML type hints. Patterns to match: type=, ObjectDataProvider, ExpandedWrapper, System.Windows.Data, XamlReader, System.Diagnostics.Process. Example ModSecurity rule: SecRule REQUEST_COOKIES:DNNPersonalization "@rx (?i)(ObjectDataProvider|ExpandedWrapper|XamlReader|System\.Diagnostics)" "deny,id:1009822".
   • IPS/network: Enable a Suricata signature on http.cookie matching DNNPersonalization plus ObjectDataProvider. Most commercial rulesets already ship CVE-2017-9822 signatures. Switch those rules to drop rather than alert.
   • Segmentation: Egress-filter the IIS web servers so they can only reach required destinations (database, update sources). This kills payload staging and reverse shells. Do not allow direct DMZ-to-Active Directory paths.
   • Endpoint hardening: Run the IIS app pool as a dedicated ApplicationPoolIdentity with no local admin rights. Limit web-root write permissions to the paths DNN strictly needs. Use an ASR rule or EDR policy to block child processes of w3wp.exe (cmd, powershell, rundll32, certutil).
   • Database least privilege: Restrict the DNN SQL login to db_owner on its own database only, never sysadmin. Disable xp_cmdshell.
3. 03

   Runbook step 3

   Detection rules

   • IIS access logs: Enable the W3C cs(Cookie) field, which is off by default. Then hunt for requests whose cookie contains DNNPersonalization= together with <profile> and type=. These usually target non-existent pages, because the 404 handler is what parses the cookie. SPL: index=iis cs_Cookie="*DNNPersonalization*" (cs_Cookie="*ObjectDataProvider*" OR cs_Cookie="*ExpandedWrapper*").
   • Process ancestry (Sysmon EID 1 / Security 4688): Alert when w3wp.exe spawns cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe or whoami.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "w3wp.exe" and FileName in~ ("cmd.exe","powershell.exe","certutil.exe","whoami.exe").
   • File creation (Sysmon EID 11): Alert when w3wp.exe writes .aspx, .ashx, .asmx or .config files into the DNN web root. Sigma shape: Image|endswith: '\w3wp.exe' and TargetFilename|endswith: ['.aspx','.ashx'].
   • Network telemetry (Zeek/Suricata): Watch for new outbound connections from the web server to unfamiliar external IPs, such as reverse shells or payload downloads, shortly after suspicious 404 bursts.
   • Ransomware precursors: After web exploitation, watch for LSASS access (Sysmon EID 10) and new local accounts (EID 4720). Also watch for lateral movement originating from the web server (EID 4624 logon type 3/10 on downstream hosts).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

Source: NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Dnnsoftware Dnn.Platform

Weakness classes (CWE)

• CWE-94Improper Control of Generation of Code ('Code Injection')

  Base

  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  Entry at MITRE CWE-94

References & sources

• NVD (NIST)vuln/detail/CVE-2017-9822advisory
• GitHub Security Advisoriesadvisories/GHSA-x2rg-fmcv-crq5advisory
• packetstormsecurity.comfiles/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Exec…web, x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• dnnsoftware.comcommunity/security/security-centerweb, x_refsource_CONFIRM, Product, Vendor advisory
• securityfocus.com102213web, Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9822government-resource, US government resource