# Logic Flaw Leading to RCE in Dynamicweb 9.5.0 - 9.12.7

Dynamicweb setup endpoint's &&/|| logic flaw let unauthenticated attackers re-run setup actions, creating an admin user and uploading an ASPX webshell for RCE.

- Payout: Research
- Severity: critical
- Program: Dynamicweb
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2022-25369
- Write-up quality: 7/10
- Original: https://www.assetnote.io/resources/research/logic-flaw-leading-to-rce-in-dynamicweb-9-5-0-9-12-7
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-logic-flaw-leading-to-rce-in-dynamicweb-9-5-0-9-12-7
- Tags: domain:web impact:privesc impact:rce kind:research platform:research sev:critical tech:dotnet technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic vuln:rce

**Target:** ASP.NET admin setup endpoint /Admin/Access/Setup/Default.aspx
**Root cause:** Page_Load used `string.IsNullOrEmpty(Action) && SetupCompleted()` to gate the setup redirect; the && should be ||, so any non-empty Action bypasses the completed-setup check and reaches HandleAction.
**Steps:**
1. Request `GET /Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername=admin1&adminpassword=admin1&adminemail=test@test.com&adminname=test` unauthenticated
2. HandleAction dispatches to SetupAdministrator, creating admin1/admin1
3. Log in to /Admin with the new admin credentials
4. Upload an ASPX webshell via the admin panel to execute commands
**How found:** Code review of the setup Page_Load: noticed the guard condition combined IsNullOrEmpty(Action) with SetupCompleted() using &&, meaning a populated Action skips the redirect; traced Action into HandleAction to enumerate reachable setup operations.
**Exploitation:** Unauthenticated attacker hits the setup endpoint with Action=createadministrator to add an admin account, authenticates to the admin panel, then uploads an ASPX webshell to gain OS command execution on the server.
**Escalation:** Admin account creation chained to webshell upload for full RCE.
**Insight:** Audit first-run/setup/install endpoints for guards that only redirect when a parameter is empty—populate the parameter to skip the completed-setup check and reach privileged setup actions like createadministrator.