Security advisory: Update ClientDependency immediately
Impact: High, requires immediate action. This advisory is the result of a private penetration test, we have no reports that the bug is being exploited in the wild.
The following Umbraco versions needs to be updated:
- 4.11.9 - 4.11.10
- 6.0.6 - 6.2.6
- 7.0.0 - 7.2.2
- any Umbraco website using ClientDependency version 184.108.40.206 or lower
If you have a different Umbraco version than the ones listed above but you have version 220.127.116.11 of ClientDependency running in your website then you also need to update.
Update, Feb 16 16:57 GMT+1: If you have ever upgraded your site from a version below 7.2.3 then you should check the version of ClientDependency.Core.dll (it should be 18.104.22.168 or higher) and you have to go into your live environment and find either the ~/App_Data/ClientDependencyfolder or the ~/App_Data/Temp/ClientDependency folder and DELETE all the files in that folder, old cached files may still expose private information if you leave them there.
Does my site need to be updated?
If you are uncertain about what version you are running, get in touch with the person / agency that built your Umbraco site and let them help you. It is an easy fix, but we only recommend experienced Umbraco users to do the update.
How to update?
If you are NOT using NuGet then you need to copy the new version of ClientDependency.Core.dll (version 22.214.171.124, compatible with .net 4.5), ClientDependency.Core.dll (version 126.96.36.199, compatible with .net 4.0) or ClientDependency.Core.dll (version 188.8.131.52, compatible with .net 3.5) into the bin folder of your website.
This version is fully backwards compatible with version 184.108.40.206 so you don't need to worry about breaking anything.
Note: After copying in the new version you have to go into your live environment and find either the ~/App_Data/ClientDependency folder or the ~/App_Data/Temp/ClientDependency folder and DELETE all the files in that folder, old cached files may still expose private information if you leave them there.
If your ARE using NuGet then the following instructions apply. Run the following command in your Package Manager Console in Visual Studio:
Update-Package ClientDependency -Version 220.127.116.11
If you don't specify the version in this command you will be upgraded to the latest version.
Alternatively you can use the NuGet UI to search for the ClientDependency package and update it to either version 18.104.22.168 or the latest version.
NuGet might update your web.config like Andy Landsdowne points out, you can revert those changes to the web.config file.
Note: After upgrading to the new version you have to go into your live environment and find either the ~/App_Data/ClientDependencyfolder or the ~/App_Data/Temp/ClientDependency folder and DELETE all the files in that folder, old cached files may still expose private information if you leave them there.
If you have additional questions not covered in this blog post please use the forum post on Our Umbraco dedicated to this topic. You can subscribe to email notifications for this forum post (hit the "follow" button at the top right) to receive updates.
Details about the issue
Summary:A library used by Umbraco contains a security flaw
Fix: Replace a single assembly file or run a NuGet update command. Completely backwards compatible.
The newly discovered vulnerability is no longer present in version 22.214.171.124 of ClientDependency and we advise you to make sure that you are using at least version 126.96.36.199. Of course, to get the most stable version with extra bug fixes you should upgrade to the latest stable version (1.9.2).
We want to thank Steve Smith from BMT Group Ltd for responsibly disclosing this issue with us.
We apologize for the inconvenience. Security issues are of the highest priority for us as we recognize that the trust in Umbraco depends heavily on this.
If you want to know more about how we handle security in Umbraco, you can read more about Umbraco Security here.
If you don't know Umbraco, here are some numbers behind the world's friendliest CMS
One of the biggest benefits of using Umbraco is that the community is incredibly pro-active, extremely friendly and helpful.
Chances are that if you get an idea for something you would like to build in Umbraco, someone has already built it. So it is very likely that you can get good and friendly advice from someone from the Umbraco community on Our - just ask.
Number of active installs401.858
Number of active members in the community220.022
Known free Umbraco packages available320
Want to be updated on everything Umbraco?
Be one of the first to know about special offers on our products and services. Get invitations to Umbraco events and festivals sent directly to your inbox.
All you need to do is get on our mailing list and soon you'll become a true Umbraco-know-it-all.
Sign up for our monthly newsletter