{"id":2898,"date":"2017-07-31T09:36:02","date_gmt":"2017-07-31T08:36:02","guid":{"rendered":"https:\/\/dn-www.azurewebsites.net\/2017\/07\/31\/umbraco-forms-local-file-inclusion\/"},"modified":"2024-02-06T10:17:42","modified_gmt":"2024-02-06T10:17:42","slug":"umbraco-forms-local-file-inclusion","status":"publish","type":"post","link":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/","title":{"rendered":"Umbraco Forms Local File Inclusion"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2898\" class=\"elementor elementor-2898\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-501a18f8 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"501a18f8\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-265af83f\" data-id=\"265af83f\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-421290fe elementor-widget elementor-widget-text-editor\" data-id=\"421290fe\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called Umbraco Forms.<\/p>\n<p>Umbraco Forms version 4.1.5, 4.2.1, 4.3.2 and earlier minor versions are vulnerable to local file inclusion (LFI) in the &#8220;GetExport&#8221; web API endpoint within the administration section. Umbraco Forms is a package for the Umbraco Content Management System (CMS) which allows administrators to create and manage website forms along with its entries. The package is not included in a default installation, but there is an easy-to-install button as the package is commercially supported and developed by Umbraco.<\/p>\n<h2>Vulnerability Details<\/h2>\n<p>In order to exploit this vulnerability, access to the form management page is required. The Umbraco Forms package provides an export functionality which allows administrators to export the form entries into an Excel file using the URL below.<\/p>\n<pre>https:\/\/localhost\/umbraco\/backoffice\/UmbracoForms\/Export\/GetExport?formId=$FORM_ID&amp;fileName=$FORM_NAME.xlsx<\/pre>\n<p>The &#8220;$FORM_ID&#8221; given has to be a valid one, which can be easily obtained as it is a part of the URL of the form management page. The &#8220;filename&#8221; parameter is normally used by Umbraco Forms to indicate the filename of the Excel file, however, an attacker can specify arbitrary paths to a file. An example is shown below, where a relative path to the &#8220;web.config&#8221; file is specified:<\/p>\n<pre>https:\/\/localhost\/umbraco\/backoffice\/UmbracoForms\/Export\/GetExport?formId=$FORM_ID&amp;fileName=..\/..\/..\/..\/..\/web.config<\/pre>\n<p>Next, the website responds back by including the &#8220;web.config&#8221; file in the HTTP response as an attachment. The following shows the content of the downloaded file.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"\/wp-content\/uploads\/files\/sites\/other\/files\/umbraco_forms_webconfig_edited.PNG\" style=\"width: 499px; height: 314px;\"><\/p>\n<p>The vulnerability can be exploited either by using a full path or the relative path to a file.<\/p>\n<h2>Impact<\/h2>\n<p>The vulnerability allows an authenticated attacker with access to the form management section to read arbitrary file from the local file system that the web daemon has access to. This could lead to server compromise.<\/p>\n<h2>Solution<\/h2>\n<p>The Umbraco team was immediately notified by Dionach. Many thanks to the team for quickly responding to the vulnerability report and publishing a patch for it. Please see this <a href=\"https:\/\/umbraco.com\/follow-us\/blog-archive\/2016\/10\/14\/umbraco-forms-security-notice\/\">Umbraco security advisory<\/a> for more information.<\/p>\n<p>Please note that the patch prevents an attacker from traversing between folders and using a full file path, however, we can still specify an arbitrary file name to obtain a different file within the same folder. As far as I am aware, this is an intended functionality.<\/p><p><br><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called Umbraco Forms. Umbraco Forms version 4.1.5, 4.2.1, 4.3.2 and earlier minor versions are vulnerable to local file inclusion (LFI) in the &#8220;GetExport&#8221; web API endpoint within the administration section. Umbraco [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[215,207],"class_list":["post-2898","post","type-post","status-publish","format-standard","hentry","category-researchblog","tag-vulnerabilities","tag-web_applications","wpbf-post"],"contentshake_article_id":"","yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Umbraco Forms Local File Inclusion<\/title>\n<meta name=\"description\" content=\"In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/\" \/>\n<meta property=\"og:locale\" content=\"nl_NL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Umbraco Forms Local File Inclusion\" \/>\n<meta property=\"og:description\" content=\"In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/\" \/>\n<meta property=\"og:site_name\" content=\"Dionach\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/dionachcyber\" \/>\n<meta property=\"article:published_time\" content=\"2017-07-31T08:36:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-06T10:17:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg?fit=512%2C512&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"512\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Dionach Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@dionachcyber\" \/>\n<meta name=\"twitter:site\" content=\"@dionachcyber\" \/>\n<meta name=\"twitter:label1\" content=\"Geschreven door\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dionach Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Geschatte leestijd\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/\"},\"author\":{\"name\":\"Dionach Admin\",\"@id\":\"https:\/\/dionach.com\/nl\/#\/schema\/person\/e73f3537233924cf4944f7807068b3c8\"},\"headline\":\"Umbraco Forms Local File Inclusion\",\"datePublished\":\"2017-07-31T08:36:02+00:00\",\"dateModified\":\"2024-02-06T10:17:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/\"},\"wordCount\":381,\"publisher\":{\"@id\":\"https:\/\/dionach.com\/nl\/#organization\"},\"keywords\":[\"vulnerabilities\",\"web applications\"],\"articleSection\":[\"researchblog\"],\"inLanguage\":\"nl-NL\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/\",\"url\":\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/\",\"name\":\"Umbraco Forms Local File Inclusion\",\"isPartOf\":{\"@id\":\"https:\/\/dionach.com\/nl\/#website\"},\"datePublished\":\"2017-07-31T08:36:02+00:00\",\"dateModified\":\"2024-02-06T10:17:42+00:00\",\"description\":\"In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called\",\"breadcrumb\":{\"@id\":\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/#breadcrumb\"},\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/dionach.com\/nl\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Umbraco Forms Local File Inclusion\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/dionach.com\/nl\/#website\",\"url\":\"https:\/\/dionach.com\/nl\/\",\"name\":\"Dionach\",\"description\":\"Real Security in a Virtual World\",\"publisher\":{\"@id\":\"https:\/\/dionach.com\/nl\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/dionach.com\/nl\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nl-NL\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/dionach.com\/nl\/#organization\",\"name\":\"Dionach\",\"url\":\"https:\/\/dionach.com\/nl\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\/\/dionach.com\/nl\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg\",\"contentUrl\":\"https:\/\/www.dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg\",\"width\":512,\"height\":512,\"caption\":\"Dionach\"},\"image\":{\"@id\":\"https:\/\/dionach.com\/nl\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/dionachcyber\",\"https:\/\/x.com\/dionachcyber\",\"https:\/\/uk.linkedin.com\/company\/dionach-ltd\",\"https:\/\/www.instagram.com\/dionachcyber\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/dionach.com\/nl\/#\/schema\/person\/e73f3537233924cf4944f7807068b3c8\",\"name\":\"Dionach Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g\",\"caption\":\"Dionach Admin\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Umbraco Forms Local File Inclusion","description":"In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/","og_locale":"nl_NL","og_type":"article","og_title":"Umbraco Forms Local File Inclusion","og_description":"In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called","og_url":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/","og_site_name":"Dionach","article_publisher":"https:\/\/www.facebook.com\/dionachcyber","article_published_time":"2017-07-31T08:36:02+00:00","article_modified_time":"2024-02-06T10:17:42+00:00","og_image":[{"width":512,"height":512,"url":"https:\/\/i0.wp.com\/dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg?fit=512%2C512&ssl=1","type":"image\/jpeg"}],"author":"Dionach Admin","twitter_card":"summary_large_image","twitter_creator":"@dionachcyber","twitter_site":"@dionachcyber","twitter_misc":{"Geschreven door":"Dionach Admin","Geschatte leestijd":"3 minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/#article","isPartOf":{"@id":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/"},"author":{"name":"Dionach Admin","@id":"https:\/\/dionach.com\/nl\/#\/schema\/person\/e73f3537233924cf4944f7807068b3c8"},"headline":"Umbraco Forms Local File Inclusion","datePublished":"2017-07-31T08:36:02+00:00","dateModified":"2024-02-06T10:17:42+00:00","mainEntityOfPage":{"@id":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/"},"wordCount":381,"publisher":{"@id":"https:\/\/dionach.com\/nl\/#organization"},"keywords":["vulnerabilities","web applications"],"articleSection":["researchblog"],"inLanguage":"nl-NL"},{"@type":"WebPage","@id":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/","url":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/","name":"Umbraco Forms Local File Inclusion","isPartOf":{"@id":"https:\/\/dionach.com\/nl\/#website"},"datePublished":"2017-07-31T08:36:02+00:00","dateModified":"2024-02-06T10:17:42+00:00","description":"In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called","breadcrumb":{"@id":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/#breadcrumb"},"inLanguage":"nl-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/dionach.com\/nl\/umbraco-forms-local-file-inclusion\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/dionach.com\/nl\/"},{"@type":"ListItem","position":2,"name":"Umbraco Forms Local File Inclusion"}]},{"@type":"WebSite","@id":"https:\/\/dionach.com\/nl\/#website","url":"https:\/\/dionach.com\/nl\/","name":"Dionach","description":"Real Security in a Virtual World","publisher":{"@id":"https:\/\/dionach.com\/nl\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dionach.com\/nl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nl-NL"},{"@type":"Organization","@id":"https:\/\/dionach.com\/nl\/#organization","name":"Dionach","url":"https:\/\/dionach.com\/nl\/","logo":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/dionach.com\/nl\/#\/schema\/logo\/image\/","url":"https:\/\/www.dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg","contentUrl":"https:\/\/www.dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg","width":512,"height":512,"caption":"Dionach"},"image":{"@id":"https:\/\/dionach.com\/nl\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/dionachcyber","https:\/\/x.com\/dionachcyber","https:\/\/uk.linkedin.com\/company\/dionach-ltd","https:\/\/www.instagram.com\/dionachcyber\/"]},{"@type":"Person","@id":"https:\/\/dionach.com\/nl\/#\/schema\/person\/e73f3537233924cf4944f7807068b3c8","name":"Dionach Admin","image":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g","caption":"Dionach Admin"}}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/ph4Ojq-KK","_links":{"self":[{"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/posts\/2898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/comments?post=2898"}],"version-history":[{"count":0,"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/posts\/2898\/revisions"}],"wp:attachment":[{"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/media?parent=2898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/categories?post=2898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dionach.com\/nl\/wp-json\/wp\/v2\/tags?post=2898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}