Access Control Bypass Affecting umbraco.cms.core Open this link in a new tab package, versions [,9.2.0)


0.0
high
  • Attack Complexity

    Low

  • Scope

    Changed

  • Confidentiality

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-DOTNET-UMBRACOCMSCORE-2359041

  • published

    23 Jan 2022

  • disclosed

    21 Jan 2022

  • credit

    Unknown

How to fix?

Upgrade Umbraco.Cms.Core to version 9.2.0 or higher.

Overview

Affected versions of this package are vulnerable to Access Control Bypass via a configuration element named UmbracoApplicationUrl which is used whenever the application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site.

If the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the UmbracoApplicationUrl is used. For instance, the attacker is able to change the URL users receive when resetting their password so that it points to the attacker's server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.

References