Published: March 14, 2008
Version: 1.0
Maximum Severity Rating: Critical
Background
For the 3.0 release of DotNetNuke we added a file manager module. By default this module is only accessible to Admin or Host users. There is a problem with the code that could allow an admin user to upload arbitrary files. With this level of access it would be possible for an Admin user to gain full Host access to the portal.
Issue Summary
The file manager component has a problem where a user could upload a file of a type that does not match the list of allowable file types. This vulnerability allowed for an Admin user to upload a file that could then grant them access to the entire portal i.e. an admin user account permission escalation.
Mitigating factors
- The user must have access to the file manager.
- By default this issue only affects Admin users.
Affected DotNetNuke versions
Non-Affected Versions:
Fix(s) for issue
To fix this problem, you are recommended to update to the latest version of DotNetNuke (4.8.2 at time of writing)
Acknowledgments
Morteza Kermani
Security Policy
Click here to read more details on the DotNetnuke Security Policy