CVE-2021-46345

What it actually does

The vulnerability triggers an assertion failure 'cesu8_cursor_p == cesu8_end_p' in the CESU-8 string cursor handling within lit-strings.c, causing immediate process termination.

Why it matters to the business

Results in denial-of-service conditions that interrupt application availability and require manual restarts, with low exploitation likelihood but potential for repeated service disruption in environments using the affected component.

How an attack unfolds

An attacker supplies specially crafted input containing malformed CESU-8 sequences to any code path that invokes the JerryScript string literal processing routines, violating internal cursor invariants and forcing the assertion to fail.

How to fix it

Upgrade DotNetNuke.Core to version 9.2.2 or later to incorporate the corrected string handling logic.

How to confirm the fix worked

Confirm the installed package version meets or exceeds 9.2.2; re-test previously triggering inputs to verify absence of assertion failures or crashes.

Typical attack path

1. Locate an entry point that feeds untrusted data into the JavaScript engine's string handling
2. Craft input that causes the CESU-8 cursor to desynchronize from the expected end position
3. Submit the payload to trigger the failed assertion and crash the process
4. Repeat as needed to maintain service interruption

How to detect it

Review application and system logs for abrupt terminations or assertion messages originating from lit-strings.c or equivalent string processing routines shortly after receipt of untrusted input.

What your security team should do

• Apply the 9.2.2 update at the earliest maintenance window given the public exploit availability
• Implement input sanitization or size limits on data reaching the embedded script engine
• Configure monitoring for unexpected process terminations tied to string processing