DotNetNuke.Core Vulnerável a XSS Persistente via Título do Módulo

An attacker can leverage this XSS vulnerability to inject arbitrary JavaScript code into the module title field. When a user views the affected module, the injected script will execute within their browser context. This can lead to a variety of malicious outcomes, including session hijacking, redirection to phishing sites, and the theft of sensitive information like cookies and authentication tokens. The impact is particularly severe because module titles are often displayed prominently on websites, increasing the likelihood of user exposure. A successful attack could also allow an attacker to modify website content, leading to defacement or the dissemination of malware.

Websites and applications utilizing DotNetNuke.Core versions 9.9.1 and earlier are at risk. This includes organizations relying on DotNetNuke for content management and those hosting DotNetNuke installations on shared hosting environments, where vulnerabilities can be more easily exploited due to limited control over the underlying infrastructure.

• .NET / web: Inspect module title fields for unusual characters or patterns indicative of JavaScript injection. Use browser developer tools to monitor for unexpected script execution. • .NET / web: Review DotNetNuke logs for suspicious activity related to module creation or modification. • .NET / web: Utilize a WAF to detect and block requests containing potentially malicious rich text content in module titles. Look for patterns like <script> tags or event handlers. • .NET / web: Monitor for unusual network traffic originating from the DotNetNuke server, which could indicate exploitation.

1. 2026-01-28Disclosure

   disclosure

1. Reservado2026-01-27
2. Publicada2026-01-28
3. Modificada2026-02-03
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-24838 is to upgrade DotNetNuke.Core to version 9.13.10 or later. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious rich text content in module titles. Specifically, look for patterns indicative of JavaScript injection attempts. Additionally, carefully review and sanitize any user-supplied input used in module titles before rendering them on the website. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a module title and verifying that it does not execute.