Listen to this Post
How the mentioned vulnerability works: Protected files uploaded through Umbraco Forms are stored in the “/media/forms/upload/” directory with path components including form GUID, entry GUID, and filename. When these image files are requested, the ImageSharp library processes them for resizing or formatting, and by default, it sets aggressive HTTP cache headers such as “Cache-Control: public, max-age=…” in responses. If a content delivery network (CDN) or any intermediary caching layer is configured in front of the Umbraco website, it interprets these headers as instructions to cache the file content. After an authenticated user initially requests a protected file, the CDN stores the response. Subsequently, an unauthenticated user can access the same URL, and the CDN may serve the cached copy directly without forwarding the request to the origin server for authentication checks. This bypasses the intended file protection, leading to unauthorized disclosure of sensitive uploaded files. The exploitation requires knowledge of the specific URL structure, which includes the GUIDs and filename, and is only effective when a CDN is present, as without it, the cache headers do not cause intermediary storage.
Platform: Umbraco Forms
Version: All supported versions
Vulnerability: Caching bypass
Severity: Critical
date: 2024
Prediction: Patched in versions
What Undercode Say:
Analytics:
curl -I /media/forms/upload/
app.Use(async (context, next) =>
{
var path = context.Request.Path.Value;
if (!string.IsNullOrEmpty(path) && path.StartsWith(“/media/forms/upload/”, StringComparison.OrdinalIgnoreCase))
{
context.Response.OnStarting(() =>
{
context.Response.Headers[“Cache-Control”] = “private, no-store, no-cache, must-revalidate”;
context.Response.Headers[“Pragma”] = “no-cache”;
context.Response.Headers[“Expires”] = “0”;
return Task.CompletedTask;
});
}
await next();
});
How Exploit:
Access cached URLs
Protection from this CVE
Apply patch updates
Impact:
Unauthorized file access
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
