CVE-2024-47819: Umbraco.Cms.StaticAssets Cross-Site Scripting Vulnerability

MODERATE
Advisory Identifier: GHSA-c5g6-6xf7-qxp3
Share
CVSS 4.2
CWE-80 CWE-79
Published
Advisory Summary

CVE-2024-47819 is a MODERATE (CVSS 4.2) cross-site scripting vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)) affecting Umbraco.Cms.StaticAssets libraries in the NuGet ecosystem. The issue involves umbraco cms vulnerable to stored cross-site scripting in the "dictionary name" on dictionary section. Remediation is available by upgrading affected packages to version 14.3.1.

CVE-2024-47819 at a Glance

CVE Identifier CVE-2024-47819
GHSA Identifier GHSA-c5g6-6xf7-qxp3
Severity MODERATE
CVSS v3.1 Base Score 4.2
CWE Classification CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Product Umbraco.Cms.StaticAssets
Package Ecosystem NuGet
Published Date
Last Updated

Security Impact

CVSS: 4.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required High (PR:H)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2024-47819

To remediate this vulnerability, upgrade all affected Umbraco.Cms.StaticAssets dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Umbraco.Cms.StaticAssets fixed: 14.3.1 
Upgrade Umbraco.Cms.StaticAssets to 14.3.1
@umbraco-cms/backoffice fixed: 14.3.1 
npm install @umbraco-cms/backoffice@14.3.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for Umbraco.Cms.StaticAssets

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-47819, inspect your project dependencies for Umbraco.Cms.StaticAssets:

inspect dependencies for Umbraco.Cms.StaticAssets

Analyze the terminal output to locate any version of Umbraco.Cms.StaticAssets in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 14.3.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. In Umbraco.Cms.StaticAssets, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. ### Patches Will be patched in 14.3.1 and 15.0.0. ### Workarounds Ensure that access to the Dictionary section is only granted to trusted users.

CVE-2024-47819 Affected Umbraco.Cms.StaticAssets Versions

2 component(s)
Fixed Versions:
14.3.1
Product / Package Ecosystem Affected Versions Fixed Version
Umbraco.Cms.StaticAssets
nuget/Umbraco.Cms.StaticAssets
NuGet
≥ 14.0.0
< 14.3.1
14.3.1
@umbraco-cms/backoffice
npm/@umbraco-cms/backoffice
npm
≥ 14.0.0
< 14.3.1
14.3.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-c5g6-6xf7-qxp3
NVD — CVE-2024-47819 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47819
Umbraco.Cms.StaticAssets Source Repository REPOSITORY
https://github.com/umbraco/Umbraco-CMS

Frequently Asked Questions

What is CVE-2024-47819?
CVE-2024-47819 is a security vulnerability in Umbraco.Cms.StaticAssets involving Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).
Which Umbraco.Cms.StaticAssets versions are affected?
Affected versions include releases prior to 14.3.1 across affected packages: Umbraco.Cms.StaticAssets, @umbraco-cms/backoffice.
What version fixes CVE-2024-47819?
Upgrading to 14.3.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is Umbraco.Cms.StaticAssets affected?
Yes, Umbraco.Cms.StaticAssets is affected in releases prior to 14.3.1. Upgrade your dependency to 14.3.1 or later.
Is @umbraco-cms/backoffice affected?
Yes, @umbraco-cms/backoffice is affected in releases prior to 14.3.1. Upgrade your dependency to 14.3.1 or later.
What is the CVSS score of CVE-2024-47819?
CVE-2024-47819 has a CVSS v3.1 base score of 4.2 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N.
What CWE is associated with CVE-2024-47819?
CVE-2024-47819 is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.).
How can I check NuGet dependencies for CVE-2024-47819?
Run the dependency tree command: 'inspect dependencies for Umbraco.Cms.StaticAssets'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c5g6-6xf7-qxp3",
  "modified" : "2024-10-22T19:22:19Z",
  "published" : "2024-10-22T17:50:08Z",
  "aliases" : [ "CVE-2024-47819" ],
  "summary" : "Umbraco CMS vulnerable to stored Cross-site Scripting in the \"dictionary name\" on Dictionary section",
  "details" : "### Impact\nThis can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content.\n\n### Patches\nWill be patched in 14.3.1 and 15.0.0.\n\n### Workarounds\nEnsure that access to the Dictionary section is only granted to trusted users.\n\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Umbraco.Cms.StaticAssets"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "14.0.0"
      }, {
        "fixed" : "14.3.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@umbraco-cms/backoffice"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "14.0.0"
      }, {
        "fixed" : "14.3.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-c5g6-6xf7-qxp3"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-47819"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/umbraco/Umbraco-CMS"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79", "CWE-80" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-10-22T17:50:08Z",
    "nvd_published_at" : "2024-10-22T16:15:07Z"
  }
}