Published: March 14, 2008

Version: 1.0

Maximum Severity Rating: Critical

Background

For the 3.0 release of DotNetNuke we added a file manager module. By default this module is only accessible to Admin or Host users. There is a problem with the code that could allow an admin user to upload arbitrary files. With this level of access it would be possible for an Admin user to gain full Host access to the portal.

Issue Summary

The file manager component has a problem where a user could upload a file of a type that does not match the list of allowable file types. This vulnerability allowed for an Admin user to upload a file that could then grant them access to the entire portal i.e. an admin user account permission escalation.

Mitigating factors

• The user must have access to the file manager.
• By default this issue only affects Admin users.

Affected DotNetNuke versions

• All versions since 3.0.

Non-Affected Versions:

• All other versions

Fix(s) for issue

To fix this problem, you are recommended to update to the latest version of DotNetNuke (4.8.2 at time of writing)

Acknowledgments

Morteza Kermani

Security Policy

Click here to read more details on the DotNetnuke Security Policy