CVE-2024-48927: UmbracoCms and Umbraco.Cms Potential Code Execution Risk in SVG File Preview
Summary
CVE-2024-48927: Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice. Affects UmbracoCms versions >= 8.0.0, < 8.18.15. Fixed in 8.18.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Umbraco is a popular open-source content management system (CMS) built on the .NET framework. It is designed for easy content creation and management, offering a flexible and user-friendly interface. The system allows users to upload various file types, including SVG files, which are commonly used for vector graphics. However, a recent vulnerability has been identified that poses a risk to users when previewing SVG files in full-screen mode, potentially allowing for code execution.
Vulnerability Detail
The vulnerability arises from the way Umbraco handles SVG file previews in the Backoffice. When users preview SVG files in full-screen mode, there is a risk that malicious scripts embedded within the SVG files could be executed. This could lead to unauthorized actions being performed on behalf of the user, compromising the security of the application and potentially exposing sensitive data.
How To Fix
Minimum fixed version
8.18.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, server-side file validation can be implemented to strip script tags from the content of SVG files during the upload process. This can help mitigate the risk of code execution until the packages are updated. Example code for server-side validation could look like this:
public string SanitizeSvg(string svgContent) {
return Regex.Replace(svgContent, "<script.*?>.*?</script>", "", RegexOptions.Singleline);
}
Conclusion
The identified vulnerability in UmbracoCms and Umbraco.Cms poses a significant risk to users who preview SVG files in full-screen mode. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing server-side validation can serve as a temporary measure until updates are applied.
See every vulnerability recorded for UmbracoCms →
FAQ
The vulnerability allows for potential code execution when users preview SVG files in full-screen mode in the Umbraco Backoffice.
Users of UmbracoCms and Umbraco.Cms versions prior to the patched versions are at risk.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
Implement server-side file validation to strip script tags from SVG files as a temporary workaround.
The CVSS score of this vulnerability is 4.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for UmbracoCms.
