Umbraco CMS - Back-Office Account Takeover via Sign-In Redirect Manipulation (Open Redirect & Origin Validation Error & Improper Authentication)
Umbraco CMS is an open-source ASP.NET Core content management system used to build and administer websites, with a back-office interface for editors, administrators and developers. GHSA-rpv9-qp4c-g469 Several weaknesses in the back-office sign-in flow (open redirect — CWE-601, origin validation error — CWE-346, and improper authentication — CWE-287) can be chained so that an authenticated back-office user's session is handed to an attacker. No account is needed to prepare the attack, but a signed-in back-office user must open a link supplied by the attacker. Sites are exposed where the web server or hosting setup passes requests for unrecognised host names through to Umbraco — common when running on Kestrel directly, in IIS without host name bindings, or behind a reverse proxy that forwards the Host header unchanged. If the attack succeeds, the attacker obtains a back-office session with the privileges of the victim; for an administrator this means full control over content, users and configuration, and can lead to server-side code execution. Affected versions: <= 17.7.1 and <= 18.2.1. Fixed in 17.7.2 and 18.2.2: the sign-in flow now only accepts redirects to the serving host or explicitly configured hosts, and sign-in codes are hardened so they can be redeemed only by the back-office itself (this also protects sites with pre-tampered sign-in configuration). No configuration setting resolves the issue; interim mitigations are to restrict host names reaching the application (e.g. AllowedHosts in appsettings.json or explicit web-server/reverse-proxy host bindings), avoid opening untrusted back-office links while signed in, and audit the redirect URIs stored for the umbraco-back-office and umbraco-swagger OpenIddict clients for foreign host names.
