CVE-2012-10054
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload and execute arbitrary ASPX scripts on Umbraco CMS servers. Attackers can achieve remote code execution by exploiting a path traversal flaw in the SOAP endpoint. All Umbraco CMS installations prior to version 4.7.1 are affected.
💻 Affected Systems
- Umbraco CMS
📦 What is this software?
Umbraco Cms by Umbraco
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal data, install malware, or pivot to other systems.
Likely Case
Webshell deployment leading to data theft, defacement, or use as a foothold for further attacks.
If Mitigated
Attack blocked at network perimeter or detected before successful exploitation.
🎯 Exploit Status
Metasploit module available. Exploitation requires only HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.7.1
Vendor Advisory: https://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692
Restart Required: Yes
Instructions:
1. Backup your Umbraco installation and database. 2. Download Umbraco 4.7.1 or later. 3. Replace all files with the new version. 4. Restart IIS or the application pool.
🔧 Temporary Workarounds
Block vulnerable endpoint
windowsRestrict access to the codeEditorSave.asmx SOAP endpoint using web server rules.
# IIS URL Rewrite rule to block /umbraco/webservices/codeEditorSave.asmx
<rule name="Block Umbraco RCE" stopProcessing="true">
<match url="umbraco/webservices/codeEditorSave.asmx" />
<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Access denied" />
</rule>
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to Umbraco servers
- Deploy web application firewall (WAF) with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if /umbraco/webservices/codeEditorSave.asmx is accessible without authentication and Umbraco version is below 4.7.1.Check Version:
Check /umbraco/version.txt or examine web.config for Umbraco version informationVerify Fix Applied:
Verify Umbraco version is 4.7.1 or higher and the codeEditorSave.asmx endpoint is no longer accessible or properly secured.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /umbraco/webservices/codeEditorSave.asmx with SaveDLRScript operation
- File creation events in /umbraco/ directory with .aspx extension
- Unusual process execution from w3wp.exe
Network Indicators:
- SOAP requests to codeEditorSave.asmx endpoint from untrusted sources
- Upload of ASPX files to Umbraco paths
SIEM Query:
source="IIS" AND (url="*codeEditorSave.asmx*" OR url="*/umbraco/*.aspx")🔗 References
- https://github.com/umbraco/Umbraco-CMS
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rb
- https://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692
- https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html
- https://www.exploit-db.com/exploits/19671
- https://www.vulncheck.com/advisories/umbraco-cms-rce
- https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html
