Listen to this Post
All new DNN installations (versions 10.0.0 through 10.2.1) are assigned the same hardcoded Host GUID instead of a unique, randomly generated value. The Host GUID is intended to serve as a cryptographically strong, installation‑specific identifier, used internally for distinguishing DNN instances, particularly in multi‑tenant deployments. The root cause lies in the installation routine of `DotNetNuke.Core` where the GUID generation logic was incorrectly implemented or omitted, causing every new installation to receive an identical, static value. As a result, different DNN sites—even those hosted on separate servers—share the same Host GUID. This breaks the assumption of uniqueness that certain security controls and cross‑tenant isolation mechanisms rely upon. An attacker who discovers the common GUID can leverage it to impersonate a different installation, potentially bypassing tenant boundaries or misleading audit logs. The issue does not affect upgrades from version 9.x.x because those installations retain their pre‑existing GUIDs. The vulnerability is classified under CWE‑330 (Use of Insufficiently Random Values), and the fix in version 10.2.2 replaces the static GUID with a genuinely random, installation‑specific value.
dailycve form:
Platform: DNN Platform
Version: 10.0.0-10.2.1
Vulnerability : Same Host GUID
Severity: Low
date: 2026-04-10
Prediction: Patch by 2026-04-17
What Undercode Say:
bash
Check current Host GUID (DNN database query)
sqlcmd -S .\SQLEXPRESS -d DNN_Database -Q “SELECT SettingValue FROM HostSettings WHERE SettingName = ‘InstallationGuid'”
Manually generate a new, unique GUID (PowerShell)
Apply a custom GUID via SQL (temporary workaround)
sqlcmd -S .\SQLEXPRESS -d DNN_Database -Q “UPDATE HostSettings SET SettingValue = ‘NEW-GUID-HERE’ WHERE SettingName = ‘InstallationGuid'”
[/bash]
Exploit:
An attacker can obtain the known static Host GUID (e.g., {00000000-0000-0000-0000-000000000000}) and use it to impersonate another DNN installation in a shared hosting environment. This may allow cross‑site request forgery (CSRF) attacks, tampering with cross‑tenant cache entries, or misleading audit logs by inserting the victim’s GUID into malicious requests.
Protection from this CVE:
- Upgrade to DNN Platform version 10.2.2 or later.
- If immediate upgrade is impossible, manually replace the static GUID with a newly generated, unique GUID in the `HostSettings` table.
- Isolate multi‑tenant DNN instances using separate application pools or containers to limit the impact of GUID collisions.
Impact:
In multi‑tenant environments, a shared static Host GUID breaks tenant isolation, enabling attackers to potentially access or manipulate data across different DNN installations, bypass security controls that assume unique identifiers, and poison audit trails. Single‑tenant deployments face minimal direct risk but may still experience confusion in logs and monitoring systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
