CVE-2025-62802: DNN CKEditor Provider allows unauthenticated upload out-of-the-box

The vulnerability lies in the lack of authentication for endpoints responsible for file handling within the DNN CKEditor Provider. The security advisory and the patch make it clear that unauthenticated users could upload files. The patch addresses this by modifying the configuration to explicitly deny access to anonymous users for two specific endpoints: FileUploader.ashx and Browser.aspx.

FileUploader.ashx is an ASP.NET HTTP Handler, and its ProcessRequest method is the direct entry point for handling file upload requests. An attacker would exploit the vulnerability by sending a crafted request to this endpoint.

Browser.aspx is an ASP.NET page that provides a file browser. Its Page_Load method is executed every time the page is accessed. This page was also accessible to unauthenticated users and could be used as part of the exploit chain to browse or upload files.

By analyzing the source code of the application, I was able to confirm the exact class and method names associated with these endpoints. The vulnerable functions are therefore the methods that process requests for these unprotected endpoints, as they would be present in any runtime profile or stack trace during an exploit.