Umbraco hat eine Management API Vulnerability zu Path Traversal Mit Authentifizierten Benutzern

An attacker exploiting this vulnerability could upload malicious files, such as web shells or backdoors, to arbitrary locations on the server. This could lead to complete compromise of the Umbraco installation and potentially the entire underlying server infrastructure. The ability to upload files outside of designated upload directories bypasses security controls and allows for persistent code execution. Successful exploitation could result in data breaches, denial of service, or further lateral movement within the network, depending on the server's configuration and access privileges.

Organizations utilizing Umbraco.Cms versions 14.3.3 and earlier, particularly those with custom management API integrations or extensions, are at significant risk. Shared hosting environments running Umbraco.Cms are also at increased risk, as vulnerabilities can be exploited across multiple websites hosted on the same server.

• dotnet / server: Monitor Umbraco management API endpoints for unusual file upload requests. Examine web server access logs for attempts to access files outside of the designated upload directories.

Get-WinEvent -LogName Application -Filter "EventID=1001" -MaxEvents 10 | Where-Object {$_.Message -match "Umbraco.Cms.ManagementApi"}

• generic web: Use curl or wget to probe the management API endpoints and attempt to upload files with manipulated filenames containing path traversal sequences (e.g., ../../../../).

curl -F "[email protected];filename=../../../../uploads/shell.php" http://umbracosite/umbraco/management/api/content/upload

1. 2025-04-09Disclosure

   disclosure

1. Reserviert2025-04-01
2. Veröffentlicht2025-04-09
3. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to Umbraco.Cms version 14.3.4 or 15.3.1, which contain the necessary fix. If immediate upgrading is not possible, consider implementing workarounds. Umbraco provides configuration options for allowed and disallowed file extensions. Strictly limiting the allowed file types can significantly reduce the attack surface. Additionally, review and harden file system permissions to restrict write access to only authorized locations. Regularly monitor file system activity for any unauthorized file uploads.