CVE-2017-9822

CVE-2017-9822 is a remote code execution flaw (CWE-94, code injection) in DotNetNuke (DNN) before 9.1.1, caused by insecure handling of a cookie, which the vendor flagged as a critical 2017-08 security issue. An attacker triggers the flaw by sending a maliciously crafted cookie to an affected DNN site; the CVSS vector (AV:N/PR:L/UI:N) indicates network-based exploitation with low-privileged access required and no user interaction. Successful exploitation yields full high-impact compromise (C:H/I:H/A:H), meaning arbitrary code execution and the ability to read, alter, or destroy data on the web server, a suitable foothold for follow-on actions such as ransomware or cryptojacking. Any DNN (formerly DotNetNuke) deployment running a version prior to 9.1.1 is affected, which includes a broad base of CMS sites built on the vendor's platform. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, ransomware use noted), it carries a very high EPSS score of 94.8%, and a public proof of concept exists, with related server compromise campaigns such as the Zealot campaign illustrating how unpatched web servers are targeted for Monero coin-mining payloads.

What to do: Apply updates per vendor instructions by upgrading DNN/DotNetNuke to version 9.1.1 or later, prioritizing internet-facing DNN sites given the CISA KEV listing and known ransomware use. In the interim, review web server logs for suspicious or oversized cookie values being processed by DNN endpoints, and consider WAF rules to limit or inspect serialized payloads in cookies. Inventory all DNN portals in your environment and confirm their version, since older legacy deployments are the primary risk.