Trustwave SpiderLabs Security Advisory TWSL2021-005: Privilege Escalation Vulnerability in Umbraco Published: 04/01/2021 Version: 1.0 Vendor: Umbraco Product: Umbraco CMS Version affected: Prior to 8.10.0 Product description: Open-source content management system platform. Finding 1: Privilege Escalation Vulnerability *****Credit: Jonathan Yarema of Trustwave CVE: CVE-2020-29454 CWE: CWE-284 There is an privilege escalation issue in the core administrative screens which allow a low privileged user to access various resources otherwise limited to higher privileged users. The issue exists in an API endpoint which does not properly check the user’s authorization prior to returning results found in the application’s logging section. The affected endpoint paths include the following: /umbraco/backoffice/UmbracoApi/LogViewer/GetSavedSearches /umbraco/backoffice/UmbracoApi/LogViewer/GetLogLevel /umbraco/backoffice/UmbracoApi/LogViewer/GetLogs /umbraco/backoffice/UmbracoApi/LogViewer/GetNumberOfErrors /umbraco/backoffice/UmbracoApi/LogViewer/GetMessageTemplates /umbraco/backoffice/UmbracoApi/LogViewer/GetLogLevelCounts /umbraco/backoffice/UmbracoApi/Language/GetAllLanguages This log data contains whatever may have been inserted into the application logs per configuration (here, Information level) or custom exception handling routines. Note that the risk of the information leak will be contextualized based off what is actually logged by default or by whatever additional logging the application maintainer has decided to add. For example, custom logging of a failed authentication routine could potentially leak usernames and passwords to the log. Remediation Steps: Upgrade to Umbraco CMS 8.10.0 or the latest stable version. Please note that Trustwave has not verified the fixes. Revision History: 11/05/2020 - Vulnerability disclosed to vendor 12/17/2020 - Patch released by vendor 04/01/2021 - Advisory published References 1. https://umbraco.com/about-us/trust-center/security-and-umbraco/how-to-report-a-vulnerability-in-umbraco/list-of-security-contributors/ About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.