GHSA-vrqc-59mw-qqg7MediumCVSS 6.7
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
🔗 CVE IDs covered (1)
📋 Description
Description
An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered.
Impact
As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users.
Patches
The issue is patched in 16.5.1 and 17.2.2.
Workarounds
There is no workaround other than upgrading.
References
https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown
🎯 Affected products2
- nuget/Umbraco.Cms:>= 16.2.0, < 16.5.1
- nuget/Umbraco.Cms:>= 17.0.0, < 17.2.1