16683508582 2C86a1dcf0 H

Security advisory: Patch for your site is now available

We highly recommend you patch your site(s)

Authorimg 3348
Written by Jacob Midtgaard-Olesen

A newly found security issue in a library used by Umbraco could lead to disclosure of private information. We have provided a fix for the affected sites and you will find instructions on how to implement this fix in this blog post. We recommend you fix your sites as soon as possible. Umbraco Cloud sites are currently being updated automatically.

Who is affected?

As we mentioned in the Security Advisory published on September 14th, the following versions of Umbraco are affected:

  • 4.11.9 - 4.11.10
  • 6.0.6 - 6.2.6
  • 7.0.0 - 7.12.2

The vulnerability exists in an external library to Umbraco called Client Dependency Framework (CDF), versions 1.8.2.1 - 1.9.6.  In general it is recommended that you use the very latest version of CDF so that you know that you're secure and benefit from the latest bug fixes and performance improvements.

As advised in last week’s Security Advisory, we highly recommend you make time to fix this issue. If you are not technically responsible for your site, please make sure to reach out to the responsible person/agency so they can take the necessary action.

Impact

This advisory is the result of a private penetration test, we have no indication or reports that the vulnerability is currently being exploited in the wild.

The vulnerability is exploitable by any unauthenticated user requesting resources from your public website, a vulnerability of type “Local File Inclusion”. The resources that can be requested includes configuration files and other sensitive internal files not intended for public access.

 

How to update?

You can either do a manual update, update via NuGet or upgrade to newest version of Umbraco. Umbraco Cloud users will automatically be upgraded.

Manual Update

You’ll need to copy the appropriate new version (1.9.7) below of CDF into the bin folder of your website.

This version is fully backwards compatible with previous versions so you don't need to worry about breaking anything.

To avoid exposure of private information in cached files, you will also need to delete all files in ~/App_Data/ClientDependency or ~/App_Data/Temp/ClientDependency after the upgrade  (make sure to make a backup first).


Updated with NuGet

Run the following command in your Package Manager Console in Visual Studio:

Update-Package ClientDependency -Version 1.9.7

Alternatively you can use the NuGet UI to search for the ClientDependency package and update it to the latest version.

To avoid exposure of private information in cached files, you will also need to delete all files in ~/App_Data/ClientDependency or ~/App_Data/Temp/ClientDependency after the upgrade.

New versions of Umbraco

We are shipping new versions of Umbraco (7.10.5, 7.11.2, and 7.12.3) with the vulnerability fixed for new installs of Umbraco or upgrades from 7.10+. They will be ready for download at around 07:30 UTC. 

If you upgrade, please make sure to delete all files in ~/App_Data/ClientDependency or ~/App_Data/Temp/ClientDependency after the upgrade to avoid exposure of private information in cached files.


Questions?

If you have additional questions not covered in this blog post please use the forum post on Our Umbraco dedicated to this topic. You can subscribe to email notifications for this forum post (hit the "follow" button at the top right) to receive updates.


We want to thank Element78 and ProCheckUp for responsibly disclosing this issue with us.

We apologize for the inconvenience of this security issue and assure you that we continue to handle security issues with the appropriate attention and urgency.

 

Loved by developers, used by thousands around the world!

One of the biggest benefits of using Umbraco is that we have the friendliest Open Source community on this planet. A community that's incredibly pro-active, extremely talented and helpful.

If you get an idea for something you would like to build in Umbraco, chances are that someone has already built it. And if you have a question, are looking for documentation or need friendly advise, go ahead and ask the Umbraco community on Our.

Number of active installs
502567
Number of active members in the community
221745
Known free Umbraco packages available
1211

Want to be updated on everything Umbraco?

Sign up for the Umbraco newsletter and get the latest news and special offers sent directly to your inbox