DotNetNuke.Core Anfällig für Stored XSS über Modultitel

The XSS vulnerability in DotNetNuke.Core allows an attacker to inject arbitrary JavaScript code into a web page viewed by other users. This can be exploited to steal user cookies, redirect users to malicious websites, or even deface the website. Specifically, the vulnerability lies in the module title field which improperly handles rich text content. An attacker could craft a malicious module title containing JavaScript payloads that execute when a user views the module. Successful exploitation could lead to complete account takeover, allowing the attacker to perform actions on behalf of the compromised user, including accessing sensitive data and modifying website content. The impact is particularly severe given DotNetNuke's use in managing content and user access for many organizations.

Websites and applications utilizing DotNetNuke.Core versions 9.9.1 and earlier are at risk. This includes organizations relying on DotNetNuke for content management and those hosting DotNetNuke installations on shared hosting environments, where vulnerabilities can be more easily exploited due to limited control over the underlying infrastructure.

• .NET / web: Inspect module title fields for unusual characters or patterns indicative of JavaScript injection. Use browser developer tools to monitor for unexpected script execution. • .NET / web: Review DotNetNuke logs for suspicious activity related to module creation or modification. • .NET / web: Utilize a WAF to detect and block requests containing potentially malicious rich text content in module titles. Look for patterns like <script> tags or event handlers. • .NET / web: Monitor for unusual network traffic originating from the DotNetNuke server, which could indicate exploitation.

1. 2026-01-28Disclosure

   disclosure

1. Reserviert2026-01-27
2. Veröffentlicht2026-01-28
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-24838 is to upgrade DotNetNuke.Core to version 9.13.10 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing a temporary workaround by sanitizing user input in the module title field to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. Regularly review and update your DotNetNuke installation to ensure you are running the latest security patches. After upgrading, confirm the fix by attempting to create a module with a rich text title containing a simple JavaScript alert (e.g., <script>alert('XSS')</script>); the script should not execute.