Description
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Umbraco | CMS | < 4.7.1 | 4.7.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Umbraco CMS Remote Command Execution
exploit/windows/http/umbraco_upload_aspx
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rb exploit
- https://www.exploit-db.com/exploits/19671 exploit
- https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html technical-description exploit
- https://github.com/umbraco/Umbraco-CMS product
- https://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692 vendor-advisory patch
- https://www.vulncheck.com/advisories/umbraco-cms-rce third-party-advisory