CVE-2025-32372: DNN (DotNetNuke) SSRF Vulnerability

CVE-2025-32372 Overview

CVE-2025-32372 is a Server-Side Request Forgery (SSRF) vulnerability affecting DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem. This vulnerability represents a bypass for the previously known vulnerability CVE-2017-0929, enabling unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks.

The vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. This can be leveraged for internal network reconnaissance and bypassing firewalls to access restricted resources.

Critical Impact

Unauthenticated attackers can exploit this SSRF bypass to perform internal network reconnaissance, bypass firewall protections, and potentially access sensitive internal services through arbitrary GET requests from the vulnerable DNN server.

Affected Products

• DNN Platform (DotNetNuke) versions prior to 9.13.8
• dnnsoftware dotnetnuke

Discovery Timeline

• 2025-04-09 - CVE CVE-2025-32372 published to NVD
• 2025-08-26 - Last updated in NVD database

Technical Details for CVE-2025-32372

Vulnerability Analysis

This vulnerability exists in the DNN Platform's image handling functionality, specifically within the DnnImageHandler.cs component. The flaw allows attackers to bypass URL validation mechanisms that were intended to restrict image retrieval to site-owned resources only.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which occurs when an application fetches remote resources based on user-supplied input without properly validating the destination. In this case, the original fix for CVE-2017-0929 contained an incomplete validation check that could be circumvented.

The attack is characterized as "semi-blind" because while attackers can trigger outbound requests from the vulnerable server, they cannot directly observe the complete responses. However, this limitation does not prevent attackers from performing network reconnaissance through timing-based analysis, error messages, or side-channel information.

Root Cause

The root cause lies in the inadequate URL validation logic within the DnnImageHandler.cs file. The original implementation attempted to verify that URLs belonged to the site before processing image requests, but the validation could be bypassed by crafted URL inputs.

The fix introduces a new UriValidator class that provides more robust validation through the PortalAliasController. This change ensures that URL validation is performed against a centralized, trusted source of portal aliases rather than relying on potentially bypassable string-based checks.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a vulnerable DNN installation
2. Crafting malicious requests to the image handler endpoint with a manipulated Url parameter
3. Specifying internal or external target URLs to force the server to make outbound requests
4. Gathering information through response timing, error messages, or observable side effects

The vulnerability affects the image generation service, which processes URLs passed through the Url parameter. Attackers can exploit this to probe internal network infrastructure, access cloud metadata endpoints, or interact with services that trust requests from the DNN server.

// Security patch in DNN Platform/Library/Services/GeneratedImage/DnnImageHandler.cs
                             var url = parameters["Url"];
 
                             // allow only site resources when using the url parameter
-                            if (!url.StartsWith("http") || !UriBelongsToSite(new Uri(url)))
+                            IPortalAliasController portalAliasController = PortalAliasController.Instance;
+                            var uriValidator = new UriValidator(portalAliasController);
+                            if (!url.StartsWith("http") || !uriValidator.UriBelongsToSite(new Uri(url)))
                             {
                                 return this.GetEmptyImageInfo();
                             }

Source: GitHub Commit Details

Detection Methods for CVE-2025-32372

Indicators of Compromise

• Unusual outbound HTTP GET requests originating from the DNN web server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints such as 169.254.169.254 from the DNN application
• Anomalous traffic patterns in web server logs showing image handler requests with suspicious URL parameters
• Error logs indicating failed connections to unexpected internal services or ports

Detection Strategies

• Monitor web application firewall (WAF) logs for requests containing internal IP addresses or localhost references in URL parameters
• Implement network segmentation monitoring to detect unexpected outbound connections from web tier servers
• Enable detailed logging on the DNN image handler endpoint and alert on URL parameters pointing to non-standard domains
• Deploy intrusion detection signatures that identify SSRF patterns targeting common internal services

Monitoring Recommendations

• Configure egress filtering and monitoring on servers hosting DNN to detect and alert on unexpected outbound connections
• Implement DNS query logging to identify resolution attempts for internal hostnames or suspicious external domains
• Set up real-time alerting for requests to sensitive internal endpoints originating from the DNN server
• Review image handler access logs regularly for patterns indicative of reconnaissance activity

How to Mitigate CVE-2025-32372

Immediate Actions Required

• Upgrade DNN Platform to version 9.13.8 or later immediately
• Implement network segmentation to limit the DNN server's ability to reach internal services
• Configure WAF rules to block requests containing internal IP addresses or metadata endpoints in URL parameters
• Review server logs for signs of exploitation attempts

Patch Information

The vulnerability is fixed in DNN Platform version 9.13.8. The patch introduces a new UriValidator class that provides improved URL validation through the PortalAliasController.Instance. Organizations should upgrade to the patched version as soon as possible.

The security patch can be reviewed through the GitHub Commit Details and additional information is available in the GitHub Security Advisory GHSA-3f7v-qx94-666m.

Workarounds

• Implement strict egress filtering at the network level to prevent the DNN server from making requests to internal networks
• Deploy a WAF rule to block or sanitize URL parameters containing internal IP ranges, localhost, or metadata service addresses
• Consider disabling the image handler functionality if not required for business operations until patching is complete
• Apply network-level restrictions to limit the DNN server's connectivity to only required external services

# Example WAF rule to block internal IP ranges in URL parameters (ModSecurity format)
SecRule ARGS:Url "@rx (?:^|//)(?:10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|169\.254\.|localhost)" \
    "id:100001,phase:1,deny,status:403,msg:'Potential SSRF attempt blocked'"