CVE-2023-49279: Umbraco CMS vulnerable to stored XSS via SVG File Upload
Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.
Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation
or
Serve all media from an different host (e.g cdn) that where umbraco is hosted
Other sources
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49279?
CVE-2023-49279 allows an attacker to execute scripts through maliciously crafted SVG files, indicating a high severity risk.
How do I fix CVE-2023-49279?
To fix CVE-2023-49279, implement server-side file validation to prevent the upload of SVG files containing scripts.
Which versions of Umbraco CMS are affected by CVE-2023-49279?
CVE-2023-49279 affects Umbraco CMS versions from 7.0.0 to 12.2.0.
Can I mitigate CVE-2023-49279 without updating?
Yes, you can mitigate CVE-2023-49279 by implementing server-side file validation regardless of version.
What kind of attack can CVE-2023-49279 facilitate?
CVE-2023-49279 can facilitate cross-site scripting (XSS) attacks if a user is tricked into loading a malicious SVG file.