CVE-2024-34071:
Umbraco CMS Open Redirect Bypass Protection
6.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.58963%
CWE
Published
5/21/2024
Updated
5/21/2024
KEV Status
No
Technology
C#
C#Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| UmbracoCms.Core | nuget | >= 8.18.5, < 8.18.14 | 8.18.14 |
| UmbracoCms.Core | nuget | >= 10.5.0, < 10.8.6 | 10.8.6 |
| UmbracoCms.Core | nuget | >= 12.0.0, < 12.3.10 | 12.3.10 |
| UmbracoCms.Core | nuget | >= 13.0.0, < 13.3.1 | 13.3.1 |
| Umbraco.Cms.Web.BackOffice | nuget | >= 8.18.5, < 8.18.14 | 8.18.14 |
| Umbraco.Cms.Web.BackOffice | nuget | >= 10.5.0, < 10.8.6 | 10.8.6 |
| Umbraco.Cms.Web.BackOffice | nuget | >= 12.0.0, < 12.3.10 | 12.3.10 |
| Umbraco.Cms.Web.BackOffice | nuget | >= 13.0.0, < 13.3.1 | 13.3.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from improper validation of redirect URLs. The original implementations used Uri.IsWellFormedUriString, which considers protocol-relative URLs (e.g., '//evil.com') as valid relative URIs. Attackers could exploit this to create open redirects. The patches introduced WebPath.IsWellFormedWebPath, which explicitly rejects protocol-relative URLs when validating relative paths. The affected functions were in ImagesController (IsAllowed) and PreviewController (End), where the flawed validation occurred.