DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user inputGHSA-mgfv-2362-jq96
HIGHGHSA-mgfv-2362-jq96 is a high-severity (CVSS 8.6) Information Exposure vulnerability in DNN.PLATFORM. EPSS puts its 30-day exploitation probability at 35.8% (98th percentile). A fix is available for DNN.PLATFORM — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-mgfv-2362-jq96.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
DNN.PLATFORMReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | DNN.PLATFORM | ≥ 6.0.0&&< 10.0.1 | 10.0.1dotnet add package DNN.PLATFORM --version 10.0.1 |
Affected Products
dotnetnukednnsoftwareDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for DNN.PLATFORM, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update DNN.PLATFORM to 10.0.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mgfv-2362-jq96 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
How to detect GHSA-mgfv-2362-jq96
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-mgfv-2362-jq96 -u https://target- Template
- DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
- Severity
- high
- Impact
- Unauthenticated attackers can force the server to retrieve NTLM authentication hashes through malicious file uploads with Unicode-normalized paths, potentially exposing domain credentials to third-party SMB servers.
- Remediation
- Upgrade DNN Platform to version 10.0.1 or later that properly handles Unicode path normalization and prevents NTLM hash disclosure.
Template by ProjectDiscovery nuclei-templates (assetnote, DhiyaneshDk, iamnoooob), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-mgfv-2362-jq96 in your dependencies?
Find it across NuGet, including transitive dependencies.