docs(dnn): #506 social auth connectors assessment (Phase D security) - #597
Merged
Conversation
Phase D (security) of the DNN 10.3.2 + 2sxc 21 upgrade arc (#131). Read-only inventory + risk evaluation of the 4 DNN-native social auth connectors — no code changes (assessment only, per dispatch). Inventory (VERIFIED): 4 official DNN modules, all v9.11.1.0, same build SHA as DNN core -> distributed binaries (no repo source), upgraded with the platform package: - DotNetNuke.Authentication.Facebook.dll - DotNetNuke.Authentication.Google.dll - DotNetNuke.Authentication.LiveConnect.dll (Microsoft-account, legacy) - DotNetNuke.Authentication.Twitter.dll CVEs (VERIFIED via NVD/cvedetails): no CVE specific to these connectors. DNN-core CVEs cover the exposure: - CVE-2017-9822 (cookie deserialization RCE, 5.0.0-9.3.0) -> 9.11.1 above range - CVE-2025-64095 (file upload) -> patched 10.1.1, covered by upgrade to 10.3.2 Per-connector risk: Facebook/Google low (OAuth2 live, config-dependent), LiveConnect medium (legacy API, still in DNN repo), Twitter medium-high (X closed free OAuth tier 2023 -> likely broken regardless of DNN version). Recommendation: carry all 4 through the core upgrade (no independent action); CVE exposure already closed by the core upgrade; validate login flows on sandbox; disable non-functional connectors (LiveConnect/Twitter) post-validation. Scope: docs/dnn/ only. 0 files under Cards/ (release freeze respected). Runtime functional validation deferred to sandbox. Refs #506, #131, #593. Co-Authored-By: Claude <noreply@anthropic.com>
clusterManager-Myia
left a comment
clusterManager-Myia
left a comment
Collaborator
There was a problem hiding this comment.
[NanoClaw]
LGTM — assessment sécurité solide, et j'ai vérifié les deux CVE de mon côté.
Vérifications :
- CVE-2025-64095 CONFIRMÉE réelle (je l'ai recroisée hors du doc) : téléversement de fichier arbitraire non authentifié (contournement accès de l'éditeur HTML DNN), CVSS 10/10, patchée en 10.1.1, activement exploitée (détectée par CrowdSec, POC public h4x0r-dz). La conclusion du doc — « couverte par l'upgrade core 9.11.1 → 10.3.2, cible pragmatique 10.1.2+ » — est exacte. Source : NVD / cve-2025-64095.
- CVE-2017-9822 correctement caractérisée : RCE par désérialisation de cookie, range 5.0.0–9.3.0, donc 9.11.1 déjà au-dessus. Bon.
- Aucune CVE spécifique aux connecteurs auth — l'inventaire est honnête : ces 4 DLL sont de fins wrappers OAuth déléguant à
Microsoft.Owin.Security.*dans le core DNN. Aucune CVE autonome = attendu et correctement rapporté. - Risques externes bien saisis — Twitter/X : fermeture du tier OAuth gratuit en 2023 (tiers payant requis) = risque réel de breakage API-side indépendant de DNN. LiveConnect = surface API legacy Microsoft (superseded by Graph/Azure AD), marqué Medium à juste titre. Facebook/Google = Low config-dépendant.
- Scope discipliné — read-only inventory + risk eval, 0 code change (comme annoncé par le dispatch). Toute action enable/disable est reportée au sandbox post-upgrade, tracée séparément. Cohérent avec l'arc #131 et la release freeze.
Le cadrage « validation repoussée au sandbox » est le bon appel — ces connecteurs sont des binaires distribués (pas compilés depuis le repo), donc on ne peut pas valider fonctionnellement sans instance DNN live. RAS côté assessment.
— Sources : NVD CVE-2025-64095, GitHub advisory CVE-2017-9822
This was referenced Jun 25, 2026
jsboige
added a commit
that referenced
this pull request
Jun 26, 2026
Net-new turnkey navigator that organizes the #131 DNN arc by RDP-session need (not by technical phase — the dnn-localization README already does phase-order). Motivated by jsboige coupling v0.9.0 to the DNN go-live (26/06): most of the arc is agent-delivered without touching runtime; a bounded set REQUIRES jsboige's interactive RDP session. Split: - [A] Done without RDP (verify only): #596 templates, #593 CVE/target, #132 deployment, #131-step2 smoke gate, #603 runbooks. - [B] Requires RDP session, turnkey sequence: B1 bin/ repair (sandbox- bootstrap §3 recipe), B2 sandbox upgrade + smoke, B3 browser-verify 12 templates (#596 runtime un-gate), B4 prod go-live (#132 Phase 5). References the authoritative doc for each step (no duplication). Added to the #603 branch (3 DNN ops docs together: sandbox-bootstrap + go-live- smoke-test + go-live-turnkey-checklist) for coherent internal links. Related: #131, #596, #597, #132. Read-only doc, no code, no Cards/ change. Co-Authored-By: Claude-Code <noreply@anthropic.com>
jsboige
added a commit
that referenced
this pull request
Jun 27, 2026
…e-test + turnkey checklist (#603) * docs(dnn): add sandbox-bootstrap + go-live smoke-test runbooks Two new ops docs in docs/dnn/, both NET-NEW complements (no duplication of the #132 deployment runbook in docs/dnn-localization/): - sandbox-bootstrap-runbook.md (idle track): capitalizes the 2026-06-25 bin/ SDK-contamination characterization. Documents the verified boot infrastructure (LocalDB + IIS Express :8090 + DB ArgumentumGames) and the bounded clean bin/ re-deploy recipe (replace ~8 net48 assemblies: Buffers/Memory from bin/Imageflow/, fetch 5 .NET 9 contaminants at 6.0.x NuGet). The remaining ops work to un-gate #596 runtime. - go-live-smoke-test.md (secondary track): detailed URL-level smoke checklist run in the maintenance window after the #132 Phase-5 wizard. Complements #132 (which treats smoke as 1-liners). Three sections: (A) platform core, (B) 12 Razor14 templates (#596, post-dating #132), (C) 4 social-auth connectors (#597, post-dating #132) + eshop path. Sign-off gate references #132 §6 rollback contract. Related: #131 (DNN upgrade arc), #596 (runtime-pending), #597 (auth). Read-only docs, no code, no Cards/ changes (master stays bef3bc6 for v0.9.0 release). Co-Authored-By: Claude-Code <noreply@anthropic.com> * docs(dnn): add go-live turnkey checklist (RDP-session navigator) Net-new turnkey navigator that organizes the #131 DNN arc by RDP-session need (not by technical phase — the dnn-localization README already does phase-order). Motivated by jsboige coupling v0.9.0 to the DNN go-live (26/06): most of the arc is agent-delivered without touching runtime; a bounded set REQUIRES jsboige's interactive RDP session. Split: - [A] Done without RDP (verify only): #596 templates, #593 CVE/target, #132 deployment, #131-step2 smoke gate, #603 runbooks. - [B] Requires RDP session, turnkey sequence: B1 bin/ repair (sandbox- bootstrap §3 recipe), B2 sandbox upgrade + smoke, B3 browser-verify 12 templates (#596 runtime un-gate), B4 prod go-live (#132 Phase 5). References the authoritative doc for each step (no duplication). Added to the #603 branch (3 DNN ops docs together: sandbox-bootstrap + go-live- smoke-test + go-live-turnkey-checklist) for coherent internal links. Related: #131, #596, #597, #132. Read-only doc, no code, no Cards/ change. Co-Authored-By: Claude-Code <noreply@anthropic.com> * docs(dnn): add bin/ repair script (B1 turnkey, dry-run default) PowerShell tooling that makes the first RDP blocker (B1 of go-live-turnkey- checklist.md) executable in one command. The bin/ SDK contamination (5 .NET 9 contract assemblies + 2 .NET 6 markers) currently blocks all DNN sandbox boot (PR #596 issuecomment-4804068740); the recipe was documented in sandbox- bootstrap-runbook.md section 3 - this script executes it. - DryRun is the DEFAULT: prints current->target asmVer map (verified via reflection: System.Collections.Immutable 9.0.0.0 -> 6.0.0.0, etc.), no changes. -Apply executes: backup bin\ -> bin.contaminated.bak, copy 2 clean DLLs from bin\Imageflow\ (Buffers 4.0.3.0, Memory 4.0.1.1), download+extract 5 NuGet 6.0.0 (lib/net4x, verified net48-compatible), drop into bin\. - web.config redirect alignment NOT auto-applied (prints the map + points to sandbox-bootstrap section 3.3 - keeps blast radius to the binaries). - bin/ is git-tracked: prints the revert command after. Manual run in jsboige's RDP session only (no auto-execution without GO). DryRun validated on po-2023: all 7 asmVer read correctly via reflection, match the sandbox-bootstrap section 2 table. go-live-turnkey-checklist.md B1 updated to point at the script (alongside the recipe doc). Placed in docs/dnn/ (not docs/dnn/scripts/ - that dir is gitignored by the global Scripts/ rule at .gitignore:163). Added to the #603 DNN ops bundle. Related: #131, #596. Co-Authored-By: Claude-Code <noreply@anthropic.com> --------- Co-authored-by: Claude-Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase D (security) of the DNN 10.3.2 + 2sxc 21 upgrade arc (#131). Read-only inventory + risk evaluation of the 4 DNN-native social auth connectors — no code changes (assessment only, per dispatch).
Inventory (VERIFIED): 4 official DNN modules, all v9.11.1.0, same build SHA as DNN core → distributed binaries (no repo source), upgraded with the platform package: Facebook, Google, LiveConnect (Microsoft-account, legacy), Twitter.
CVEs (VERIFIED via NVD/cvedetails): no CVE specific to these connectors. DNN-core CVEs cover the exposure: CVE-2017-9822 (RCE 5.0.0–9.3.0 → 9.11.1 above range), CVE-2025-64095 (file upload, patched 10.1.1 → covered by upgrade to 10.3.2).
Per-connector risk: Facebook/Google low (OAuth2 live), LiveConnect medium (legacy API, still in DNN repo), Twitter medium-high (X closed free OAuth 2023 → likely broken regardless of DNN version).
Recommendation: carry all 4 through the core upgrade (no independent action); CVE exposure already closed by the core upgrade; validate login flows on sandbox; disable non-functional connectors (LiveConnect/Twitter) post-validation.
Scope:
docs/dnn/only. 0 files underCards/(release freeze respected). Runtime functional validation deferred to sandbox.Refs #506, #131, #593.
🤖 Worker po-2023 · dispatched by ai-01 · assessment-only (read-only)