CVE-2025-49147

Executive Summary

CVE-2025-49147 is an information disclosure vulnerability in Umbraco, a free and open-source .NET content management system. The flaw allows an unauthenticated attacker to retrieve password policy configuration details (such as minimum length, complexity requirements) via a request to an anonymously accessible endpoint. While the exposed information is limited, it provides an attacker with a blueprint for crafting more efficient brute-force attacks against user accounts. The vulnerability affects Umbraco versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. It has been patched in versions 10.8.11 and 13.9.2. The CVSS score is 5.3 (Medium), and no public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

Umbraco is distributed as a NuGet package. Organizations using the affected versions should verify their dependency chain and ensure no vulnerable versions are pulled in transitively. The patch is available via the official NuGet feed. No malicious packages or supply chain compromises have been reported in connection with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low confidentiality impact reflects that only password policy metadata is leaked, not actual passwords or user data. However, the lack of authentication and low complexity make it a viable reconnaissance vector for targeted brute-force attacks.

Deep Dive & Mechanics

The vulnerability resides in an anonymous endpoint that returns password policy settings. In Umbraco, certain endpoints are intentionally left unauthenticated to support public-facing features (e.g., password reset flows). The flaw is that the endpoint does not require authentication to return the password policy configuration.

Technical Details:

• The endpoint likely returns a JSON object containing fields such as minPasswordLength, requireDigit, requireLowercase, requireUppercase, requireNonAlphanumeric, etc.
• An attacker can send a simple HTTP GET request to the vulnerable endpoint (e.g., /umbraco/api/passwordpolicy/get) without any session token.
• The response reveals the exact password complexity rules enforced by the application.
• With this knowledge, an attacker can:
  • Reduce the search space for brute-force attacks (e.g., if minimum length is 8, they can ignore shorter passwords).
  • Tailor password lists to match complexity requirements (e.g., include at least one digit and one uppercase letter).
  • Avoid account lockout thresholds by using more targeted guesses.

Root Cause: The endpoint was not properly decorated with an authorization attribute (e.g., [Authorize] or [UmbracoAuthorize]) in the affected versions. In Umbraco 14+, the endpoint was either removed or properly secured.

Vulnerable vs. Patched Code

The following is a conceptual comparison based on typical Umbraco API controller patterns.

Vulnerable Code (Pre-Patch):

[HttpGet]
[Route("umbraco/api/passwordpolicy/get")]
public IActionResult GetPasswordPolicy()
{
    var policy = _passwordSettings.GetPolicy();
    return Ok(new {
        minLength = policy.MinLength,
        requireDigit = policy.RequireDigit,
        requireLowercase = policy.RequireLowercase,
        requireUppercase = policy.RequireUppercase,
        requireNonAlphanumeric = policy.RequireNonAlphanumeric
    });
}

Patched Code (Post-Patch):

[HttpGet]
[Route("umbraco/api/passwordpolicy/get")]
[UmbracoAuthorize] // Added authorization attribute
public IActionResult GetPasswordPolicy()
{
    var policy = _passwordSettings.GetPolicy();
    return Ok(new {
        minLength = policy.MinLength,
        requireDigit = policy.RequireDigit,
        requireLowercase = policy.RequireLowercase,
        requireUppercase = policy.RequireUppercase,
        requireNonAlphanumeric = policy.RequireNonAlphanumeric
    });
}

The patch adds an authorization check, ensuring only authenticated users can retrieve the password policy. Alternatively, the endpoint may have been removed entirely in later versions.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Umbraco 10.0.0–10.8.10 or 13.0.0–13.9.1.
• Network access to the target.

Step 1: Identify the Endpoint Use a web browser or tool like curl to probe for the vulnerable endpoint:

curl -v http://target.com/umbraco/api/passwordpolicy/get

Step 2: Extract Policy If the endpoint returns a JSON response without requiring authentication, the target is vulnerable. Example response:

{
  "minLength": 8,
  "requireDigit": true,
  "requireLowercase": true,
  "requireUppercase": true,
  "requireNonAlphanumeric": false
}

Step 3: Craft Brute-Force Attack Use the policy to generate a targeted password list. For example, with the above policy, passwords must be at least 8 characters, contain at least one digit, one lowercase, and one uppercase letter. Use a tool like hashcat or john with a custom rule:

hashcat -a 6 -m 0 hash.txt ?l?l?l?l?l?l?l?d?u ?l?l?l?l?l?l?l?d?u --stdout > targeted_wordlist.txt

Step 4: Execute Brute-Force Use a tool like Hydra or Burp Suite Intruder to perform a password spray or brute-force attack against the login endpoint, using the targeted wordlist.

Blue Team (Defensive)

Detection:

• Monitor for repeated requests to /umbraco/api/passwordpolicy/get from the same IP address.
• Alert on any unauthenticated access to this endpoint (it should never be accessed without a session).
• Correlate with subsequent brute-force attempts against the login endpoint.

Hunting:

• Search web server logs for GET /umbraco/api/passwordpolicy/get with a 401 or 200 response code.
• Look for patterns of requests to this endpoint followed by login attempts from the same source.

Prevention:

• Immediately apply the patch by upgrading to Umbraco 10.8.11 or 13.9.2.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block unauthenticated requests to the endpoint.
• Restrict access to the endpoint via IP whitelisting or VPN.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /umbraco/api/passwordpolicy/get without a valid session cookie.
  • Repeated login attempts from the same IP after a successful policy retrieval.
• File IOCs:
  • No specific file-based IOCs; the vulnerability is purely network-based.
• Log IOCs:
  • Web server logs showing 200 responses to /umbraco/api/passwordpolicy/get from unauthenticated users.
  • Authentication logs showing multiple failed login attempts with patterns matching the exposed policy.

Detection Engineering

YARA Rule

rule Detect_Umbraco_PasswordPolicy_Disclosure {
    meta:
        description = "Detects HTTP responses containing Umbraco password policy JSON"
        author = "Valters IT"
        date = "2025-04-14"
        cve = "CVE-2025-49147"
    strings:
        $policy_json = /{"minLength":\d+,"requireDigit":(true|false),"requireLowercase":(true|false),"requireUppercase":(true|false),"requireNonAlphanumeric":(true|false)}/
    condition:
        $policy_json
}

Sigma Rule

title: Umbraco Password Policy Disclosure
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to the Umbraco password policy endpoint
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/umbraco/api/passwordpolicy/get'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users (should be rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49147 Umbraco Password Policy Disclosure"; flow:to_server; content:"GET"; http_method; content:"/umbraco/api/passwordpolicy/get"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Umbraco to version 10.8.11 or 13.9.2 (or later). This is the only complete fix.
2. WAF Rule: If patching is delayed, create a WAF rule to block unauthenticated requests to /umbraco/api/passwordpolicy/get.
3. Network Segmentation: Ensure the Umbraco server is not directly exposed to the internet if possible.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to restrict API access.
• Conduct a security review of all anonymous endpoints in the application.
• Enable detailed logging and monitoring for all API endpoints.
• Consider using a brute-force protection mechanism (e.g., account lockout, CAPTCHA) on the login page.

Verification: After applying the patch, verify the fix by attempting to access the endpoint without authentication:

curl -v http://target.com/umbraco/api/passwordpolicy/get

A patched system should return a 401 Unauthorized or 404 Not Found response.

Valters IT
DevSecOps & Cyber Threat Intelligence