GHSA-hm5p-82g6-m3xh
Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | Umbraco.Forms | >= 16.0.0, < 16.4.1 | 16.4.1 |
| NuGet | Umbraco.Forms | >= 17.0.0, < 17.1.1 | 17.1.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected.
### Patches
This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1
### Workarounds
If upgrading is not immediately possible, users can mitigate this vulnerability by:
* Configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint
* Restricting network access to the Umbraco backoffice to trusted IP ranges
* Blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required
However, upgrading to the patched version is strongly recommended.
### References
Credit to Kevin Joensen from Baldur Security for finding this vulnerability
References
External links from the advisory. They lead to third-party sites.