CVE-2025-66625

Executive Summary

CVE-2025-66625 is an information disclosure vulnerability in Umbraco, an ASP.NET CMS. The flaw resides in the dictionary upload process, where temporary files are handled and deleted unsafely. An authenticated attacker with backoffice access can exploit predictable temporary file paths to enumerate the existence of arbitrary files on the server's filesystem. The vulnerability is confirmed by HTTP 500 (file exists) vs. HTTP 404 (file does not exist) responses. In certain configurations, incomplete cleanup of temporary upload files may also expose the NTLM hash of the Windows account running the Umbraco application. The issue is fixed in version 13.12.1.

Supply Chain & Package Security

This vulnerability affects the Umbraco CMS, which is distributed as a NuGet package. Organizations should verify their Umbraco package version and update to the patched version (13.12.1) to mitigate the risk. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

CVSS Score: 4.9 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

• Attack Vector (AV): Network – The attack can be performed remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – The attacker must have backoffice access.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): Low – Limited information disclosure (file existence).
• Integrity (I): None – No data modification.
• Availability (A): None – No denial of service.

Threat Level: Medium. The vulnerability requires authenticated access, but it can lead to sensitive information disclosure, including NTLM hashes in certain configurations.

Deep Dive & Mechanics

The vulnerability is rooted in the dictionary upload functionality of Umbraco. When a user uploads a dictionary file, the application creates temporary files in a predictable location. The unsafe handling and deletion of these temporary files allow an attacker to probe for the existence of arbitrary files on the server.

Mechanism:

1. The attacker, authenticated to the backoffice, initiates a dictionary upload.
2. The application creates a temporary file with a predictable name (e.g., temp_<guid>.xml).
3. The attacker can then send requests to known temporary file paths.
4. The application returns an HTTP 500 error if the file exists, and an HTTP 404 error if it does not.
5. This difference in response allows the attacker to enumerate files on the server.

NTLM Hash Exposure: In certain configurations, if the temporary files are not properly cleaned up, an attacker may be able to trigger an NTLM authentication request by referencing a UNC path in the temporary file. This can leak the NTLM hash of the Windows account running the Umbraco application.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-13.12.1): The vulnerable code likely uses a predictable temporary file path and does not properly handle cleanup. For example:

string tempPath = Path.Combine(Path.GetTempPath(), "umbraco_dict_" + Guid.NewGuid().ToString());
// ... process upload ...
// Incomplete cleanup
File.Delete(tempPath); // May fail silently or not be called

Patched Code (13.12.1): The patched version likely uses a more secure temporary file handling mechanism, such as:

• Using a random, unpredictable file name.
• Ensuring proper cleanup in a finally block.
• Validating file paths to prevent directory traversal.
• Implementing proper error handling to avoid information leakage.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the Umbraco backoffice with a valid account.
• Knowledge of the temporary file path pattern.

Exploitation Steps:

1. Log in to the Umbraco backoffice.
2. Navigate to the dictionary upload functionality.
3. Upload a dummy dictionary file to trigger temporary file creation.
4. Use a script to send requests to known temporary file paths and observe the HTTP response codes.

Example Script (Python):

import requests

session = requests.Session()
# Authenticate to backoffice (replace with actual credentials)
login_url = "https://target.com/umbraco/backoffice/UmbracoApi/Authentication/PostLogin"
session.post(login_url, json={"username": "admin", "password": "password"})

# Enumerate files
base_url = "https://target.com/umbraco/temp/"
files_to_check = ["web.config", "appsettings.json", "umbraco.config"]
for file in files_to_check:
    response = session.get(base_url + file)
    if response.status_code == 500:
        print(f"File exists: {file}")
    elif response.status_code == 404:
        print(f"File does not exist: {file}")

Blue Team

Detection:

• Monitor for unusual HTTP 500 errors on temporary file paths.
• Look for patterns of requests to */umbraco/temp/* or similar paths.
• Alert on multiple requests to non-existent files returning 500 errors.

Mitigation:

• Apply the patch by upgrading to Umbraco 13.12.1.
• Restrict backoffice access to trusted users only.
• Implement Web Application Firewall (WAF) rules to block suspicious requests.

Indicators of Compromise (IOCs)

• HTTP Requests: Requests to /umbraco/temp/ or similar paths with predictable file names.
• HTTP Status Codes: A pattern of HTTP 500 errors for file existence checks.
• Log Entries: Error logs indicating failed file access attempts.
• NTLM Hashes: Unusual NTLM authentication requests in network traffic.

Detection Engineering

YARA Rule

rule CVE_2025_66625_Umbraco_File_Enumeration {
    meta:
        description = "Detects attempts to exploit CVE-2025-66625 by enumerating files via HTTP 500/404 responses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66625"
    strings:
        $http_500 = "HTTP/1.1 500"
        $http_404 = "HTTP/1.1 404"
        $temp_path = "/umbraco/temp/"
    condition:
        any of ($http_*) and $temp_path
}

Sigma Rule

title: Umbraco File Enumeration via HTTP Status Codes
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-66625 by enumerating files via HTTP 500/404 responses
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66625
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem|contains: "/umbraco/temp/"
        sc-status:
            - 500
            - 404
    condition: selection
falsepositives:
    - Legitimate file access errors
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66625 Umbraco File Enumeration Attempt"; flow:to_server; content:"/umbraco/temp/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Umbraco to version 13.12.1 or later.
2. Review and restrict backoffice user permissions.
3. Monitor logs for unusual HTTP 500/404 patterns.

Long-term Measures:

• Implement secure file handling practices (random file names, proper cleanup).
• Use a Web Application Firewall (WAF) to block suspicious requests.
• Conduct regular security audits and penetration testing.

Workarounds:

• If immediate patching is not possible, disable the dictionary upload functionality temporarily.
• Implement additional logging and alerting for file enumeration attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence