1## autogenerated on 2025-07-16 16:18:10
2name: crowdsecurity/vpatch-CVE-2025-52488
3description: "Detects Unicode path normalization NTLM hash disclosure in DNN (DotNetNuke) via crafted file upload filename."
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - lowercase
10        match:
11          type: contains
12          value: /providers/htmleditorproviders/dnnconnect.cke/browser/fileuploader.ashx
13      - zones:
14          - FILENAMES
15        transform:
16          - lowercase
17        match:
18          type: contains
19          value: "%ef%bc%bc%ef%bc%bc"
20
21labels:
22  type: exploit
23  service: http
24  confidence: 3
25  spoofable: 0
26  behavior: "http:exploit"
27  label: "DNN DotNetNuke - NTLM Hash Disclosure"
28  classification:
29    - cve.CVE-2025-52488
30    - attack.T1557
31    - cwe.CWE-200
32