I believe this is a new exploit...

Since Feb 21, 2019, one of my DNN sites running on 8.2.2 is sending spams using the smtp relay setting stored in DNN. The email header looks like this, which definitely is generated inside DNN. and the spam are sent to the users inside DNN.

Return-Path: <example@example.com>

Received: from exampleServer ( exampleServer [xx.xx.xxx.xxx]) by xxxxxxx with SMTP;

Fri, 22 Feb 2019 12:43:00 +0800

MIME-Version: 1.0

Sender: "DotNetNuke" <example@example.com>

From: "example" <example@example.com>

To: example@example.com

Upon checking

1. event logs, there is no other login attempts beside super admin account.

2. None of the DNN files are being modified since 2017.

3. all are default DNN module except one PropertyAgent module by Ventrian.

4. Security Analyzer found nothing suspicious...

 

 

 

 

---

Thanks,
George

Where to eat? Visit GoEatOut for Food Promotion in Kuala Lumpur.

Hi Michael,

There's no mail server running on the dedicated DNN server.  The DNN smtp setting is set to another external mail server.

The weird thing is after I removed all the smtp setting in DNN, changed the admin and super user accounts email address (only 2 accounts inside), the spam still delivering from/to the same email address.

I tried to use the security analyzer to search the email address and keywords, nothing is found.

When I check the DNN files in server, non of the files are being modified since mid of 2017.

and then I also blocked outbound firewall TCP port 25 and 2525 (special smtp port for the mail server), still the spam email still happening. I can't stop them.

I actually starting to worry that other DNN in the same server are compromised and the smtp data is actually stored in other DNN folders.

 

 

 

---

Thanks,
George

Where to eat? Visit GoEatOut for Food Promotion in Kuala Lumpur.

George,

as you blocked any outgoing port on the firewall, the DNN installation should not be able to send emails, correct? Therefore I agree with Richard, there is no evidence that the spam originates from your DNN installation.

Again: Is "exampleServer [xx.xx.xxx.xxx]" your web server running DNN?

Happy DNNing!
Michael

---