Executive Summary

This vulnerability in Umbraco CMS versions 10.0.0 through 13.12.0 involves unsafe handling and deletion of temporary files during the dictionary upload process. An attacker with backoffice access can send predictable requests to temporary file paths and use the application's error responses (HTTP 500 if a file exists, 404 if it does not) to enumerate the existence of arbitrary files on the server's filesystem. Although it does not allow reading or writing file contents, in some configurations, incomplete cleanup of temporary upload files may expose the NTLM hash of the Windows account running the application. The issue is fixed in version 13.12.1.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with backoffice access to enumerate files on the server, potentially revealing sensitive information about the server's filesystem. In certain configurations, it may also expose the NTLM hash of the Windows account running Umbraco, which could be used in further attacks such as credential replay or privilege escalation. However, it does not allow direct reading or writing of file contents.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Umbraco to version 13.12.1 or later, as this version contains the fix for the vulnerability involving unsafe handling and deletion of temporary files during the dictionary upload process.

Useful 0 Not Useful 0