Summary
The package @umbraco/Umbraco-CMS contains a path traversal vulnerability in the Create Package functionality. A user with high privileges can input a relative or absolute path as the package name, which results in the creation of a folder and a packages.xml file in that location. If the folder already exists, the file can be overwritten. Although this issue requires high privileges, it presents a risk of unintended file modifications. The issue was resolved by sanitizing the package name to prevent path traversal.
Product
This vulnerability affects @umbraco/Umbraco-CMS versions:
- 8.0.0 through 8.18.9
- 9.0.0 through 10.8.0
- 11.0.0 through 12.3.3
Impact
The vulnerability allows an authenticated user with the ability to create packages to specify arbitrary paths, resulting in potential overwriting of files outside the intended directory.
Steps to reproduce
- Log in with sufficient privileges to create packages in
@umbraco/Umbraco-CMS. - Use the “Create Package” functionality and set the package name to a relative or absolute path, e.g.,
../../some/folder. - Upon creation, a
packages.xmlfile will be created in the specified directory, and if the directory already exists, the file will be overwritten.
Expected result:
The path traversal allows creating or overwriting files outside the intended directory.
Remediation
The issue was resolved by sanitizing the input for the package name to prevent path traversal attacks. The patched versions ensure that package names cannot include relative or absolute paths.
The fix was released in the following versions:
- 8.18.10
- 10.8.1
- 12.3.4
Credit
This issue was discovered and reported by Checkmarx AppSec Analyst Mário Teixeira.
