Listen to this Post
How the mentioned CVE works:
The vulnerability exists in the dictionary file upload feature within the Umbraco backoffice. During the upload process, temporary files are created with predictable names and paths on the server’s filesystem. The application does not safely handle these files before deleting them. An attacker with a backoffice session can send HTTP requests to these predictable temporary file paths. The server responds with an HTTP 500 error if the temporary file exists, and an HTTP 404 error if it does not. By observing these distinct error responses, an attacker can enumerate the existence of arbitrary files. Furthermore, in Windows-hosted environments, if the temporary file is not cleaned up properly, a subsequent request to its predictable path may trigger an automatic Windows NTLM authentication attempt from the server, leaking the NTLM hash of the Windows service account running the Umbraco application pool to a machine controlled by the attacker.
Platform: Umbraco CMS
Version: < 13.12.1
Vulnerability : File Enumeration
Severity: Medium
Date: Unspecified
Prediction: Patched 2024-01-30
What Undercode Say:
Analytics:
`curl -k “https://target/umbraco/backoffice/api/Upload/PostAddFile” -H “Authorization: Bearer [bash]” -F “[email protected]”`
`curl -s -o /dev/null -w “%{http_code}” https://target/umbraco/App_Data/TEMP/MediaUploads/[bash]`
`responder -I eth0 -wrf`
How Exploit:
1. Attacker gains backoffice access.
2. Triggers dictionary file upload.
3. Probes predictable temporary file paths.
4. Interprets 500 vs 404 errors.
- Sets up SMB listener to capture NTLM hash (if file persists).
Protection from this CVE:
Update to 13.12.1.
Use least-privileged service accounts.
Network segmentation for services.
Impact:
File existence enumeration.
NTLM hash exposure potential.
Credential relay/compromise risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
