DotNetNuke (DNN) 쿠키 역직렬화 기반 원격 코드 실행(RCE) 취약점 분석 및 대응 가이드 (CVE-2017-9822)

# DNN 설치 디렉터리 내 DotNetNuke.dll 버전을 확인하여 취약 여부 점검
$dllPath = 'C:\inetpub\wwwroot\bin\DotNetNuke.dll'
if (Test-Path $dllPath) {
    $versionInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($dllPath)
    Write-Host 'Current DNN Version:' $versionInfo.ProductVersion
    # 9.1.1 미만 버전인 경우 경고 출력
    if ([System.Version]$versionInfo.ProductVersion -lt [System.Version]'9.1.1') {
        Write-Warning 'Vulnerable DNN version detected! Please upgrade to 9.1.1 or higher.'
    } else {
        Write-Host 'DNN version is secure.' -ForegroundColor Green
    }
}

<!-- IIS web.config의 <system.webServer> 섹션 내에 추가 -->
<rewrite>
  <rules>
    <rule name='Block_DNN_Deserialization_Exploit' stopProcessing='true'>
      <match url='.*' />
      <conditions>
        <!-- 쿠키 내에 .NET 역직렬화 가젯 흔적(ObjectDataProvider, ObjectDataSource 등)이 있는지 검사 -->
        <add input='{HTTP_COOKIE}' pattern='(ObjectDataProvider|ObjectDataSource|System\.Windows\.Data|System\.IO\.MemoryStream)' />
      </conditions>
      <action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Malicious request blocked by security policy.' />
    </rule>
  </rules>
</rewrite>

# IIS 로그 디렉터리에서 역직렬화 공격 시도 탐색
$logPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*.log'
$suspiciousKeywords = @('ObjectDataProvider', 'ObjectDataSource', 'typeof', 'MethodName')

foreach ($file in Get-ChildItem $logPath) {
    Write-Host 'Scanning file:' $file.Name
    foreach ($keyword in $suspiciousKeywords) {
        Select-String -Path $file.FullName -Pattern $keyword | ForEach-Object {
            Write-Host '[ALERT] Suspicious activity detected:' $_.Line -ForegroundColor Red
        }
    }
}