# Advisory: Dynamicweb Logic Flaw Leading to RCE (CVE-2022-25369)

Unauthenticated setup endpoint in Dynamicweb before 9.12.8 lets an attacker create an admin user, then upload a web shell for RCE.

- Payout: Research
- Severity: critical
- Program: Dynamicweb
- Write-up by: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2022-25369
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/advisory-dynamicweb-logic-flaw-leading-to-rce-cve-2022-25369
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-dynamicweb-logic-flaw-leading-to-rce-cve-2022-25369
- Tags: area:web domain:web impact:privesc impact:rce kind:research platform:research sev:critical tech:dotnet vuln:access-control vuln:auth-bypass vuln:business-logic vuln:file-upload

**Target:** ASP.NET admin setup endpoint (/Admin/Access/Setup/Default.aspx)
**Root cause:** Logic issue when determining whether the product's setup phases can be re-run, allowing the createadministrator setup action to be invoked post-install without authentication.
**Steps:**
1. Send unauthenticated GET to `https://target.com/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername=admin1&adminpassword=admin1&adminemail=test@test.com&adminname=test`
2. Log in as the newly created admin1 user
3. Upload a web shell via the admin interface
4. Execute commands through the web shell
**Exploitation:** Attacker hits the setup endpoint unauthenticated to create an admin account, authenticates with those credentials, uploads a web shell through admin functionality, and achieves command execution on the server.
**Escalation:** Admin account creation chained to web shell upload for full RCE.
**Insight:** Setup/installer endpoints that gate re-runs on a logic flag rather than a hard lockout can be re-invoked post-install; probe /Admin/Access/Setup/Default.aspx-style paths with setup Action parameters on already-provisioned instances.

## Proof of concept (copied exactly from the original report)

**Unauthenticated request creating admin user**

```
https://target.com/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername=admin1&adminpassword=admin1&adminemail=test@test.com&adminname=test
```

## Write-ups of the same bug (oldest first)
- 2024-01-31: [Advisory: Dynamicweb Logic Flaw Leading to RCE (CVE-2022-25369)](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-dynamicweb-logic-flaw-leading-to-rce-cve-2022-25369) — Assetnote (this one)
- 2024-01-31: [Logic Flaw Leading to RCE in Dynamicweb 9.5.0 - 9.12.7](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-logic-flaw-leading-to-rce-in-dynamicweb-9-5-0-9-12-7) — Assetnote