CVE-2024-29035: Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
Impact Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. Affected Versions Umbraco versions 13.0.0 - 13.1.1
Patches 13.1.1
Workarounds Disabling webhooks functionality.
Other sources
Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Umbraco.Cms.Web.BackOfficeto a version that resolves this vulnerability.Fixed in 13.1.1 - Upgrade
Upgrade
nuget/Umbraco.Cms.Coreto a version that resolves this vulnerability.Fixed in 13.1.1 - Upgrade
Upgrade
Umbracoto a version that resolves this vulnerability.Fixed in 13.1.1 - Configuration
Disable webhooks functionality as a workaround.
Umbraco webhooks functionality = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29035?
CVE-2024-29035 is categorized as a medium severity vulnerability due to the exposure of sensitive webhook logs.
How do I fix CVE-2024-29035?
To fix CVE-2024-29035, update Umbraco to version 13.1.1 or later.
What versions of Umbraco are affected by CVE-2024-29035?
CVE-2024-29035 affects Umbraco versions 13.0.0 through 13.1.1.
Is there a workaround for CVE-2024-29035?
A workaround for CVE-2024-29035 is to disable the webhooks functionality in your Umbraco installation.
What information is exposed in the logs due to CVE-2024-29035?
The logs exposed by CVE-2024-29035 may contain critical information that could compromise security.