In a recent engagement, I was working on a fairly secure website and I came across an interesting Umbraco content management system (CMS) package called Umbraco Forms.
Umbraco Forms version 4.1.5, 4.2.1, 4.3.2 and earlier minor versions are vulnerable to local file inclusion (LFI) in the “GetExport” web API endpoint within the administration section. Umbraco Forms is a package for the Umbraco Content Management System (CMS) which allows administrators to create and manage website forms along with its entries. The package is not included in a default installation, but there is an easy-to-install button as the package is commercially supported and developed by Umbraco.
Vulnerability Details
In order to exploit this vulnerability, access to the form management page is required. The Umbraco Forms package provides an export functionality which allows administrators to export the form entries into an Excel file using the URL below.
https://localhost/umbraco/backoffice/UmbracoForms/Export/GetExport?formId=$FORM_ID&fileName=$FORM_NAME.xlsx
The “$FORM_ID” given has to be a valid one, which can be easily obtained as it is a part of the URL of the form management page. The “filename” parameter is normally used by Umbraco Forms to indicate the filename of the Excel file, however, an attacker can specify arbitrary paths to a file. An example is shown below, where a relative path to the “web.config” file is specified:
https://localhost/umbraco/backoffice/UmbracoForms/Export/GetExport?formId=$FORM_ID&fileName=../../../../../web.config
Next, the website responds back by including the “web.config” file in the HTTP response as an attachment. The following shows the content of the downloaded file.
The vulnerability can be exploited either by using a full path or the relative path to a file.
Impact
The vulnerability allows an authenticated attacker with access to the form management section to read arbitrary file from the local file system that the web daemon has access to. This could lead to server compromise.
Solution
The Umbraco team was immediately notified by Dionach. Many thanks to the team for quickly responding to the vulnerability report and publishing a patch for it. Please see this Umbraco security advisory for more information.
Please note that the patch prevents an attacker from traversing between folders and using a full file path, however, we can still specify an arbitrary file name to obtain a different file within the same folder. As far as I am aware, this is an intended functionality.