CVE-2024-29035: Insufficient Information (NVD-CWE-noinfo)
value: Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T15:15Z
Repository: https://github.com/umbraco/Umbraco-CMS
Language: XML
Files changed: src/Umbraco.Core/EmbeddedResources/Lang/da.xml, src/Umbraco.Core/EmbeddedResources/Lang/en_us.xml, src/Umbraco.Web.BackOffice/Mapping/WebhookMapDefinition.cs
Commit date: 2024-02-06 09:53:17 +0100
Commit message: Merge pull request from GHSA-74p6-39f2-23v3

* Don't display exception if not in debug mode

* Only display not OK status code in production
Diff: diff --git a/src/Umbraco.Core/EmbeddedResources/Lang/da.xml b/src/Umbraco.Core/EmbeddedResources/Lang/da.xml
index 1a69568c798..15cbe5f30a1 100644
--- a/src/Umbraco.Core/EmbeddedResources/Lang/da.xml
+++ b/src/Umbraco.Core/EmbeddedResources/Lang/da.xml
@@ -1013,10 +1013,12 @@
     <key alias="addDocumentType">Tilføj dokument type</key>
     <key alias="addMediaType">Tilføj medie Type</key>
     <key alias="createHeader">Opret header</key>
     <key alias="deliveries">Leverancer</key>
     <key alias="noHeaders">Der er ikke tilføjet nogen webhook headers</key>
+    <key alias="toggleDebug">Skift til debug mode for mere information.</key>
+    <key alias="statusNotOk">Ikke OK status kode.</key>
   </area>
   <area alias="language">
     <key alias="cultureCode">Culture Code</key>
     <key alias="displayName">Culture Name</key>
   </area>
diff --git a/src/Umbraco.Core/EmbeddedResources/Lang/en_us.xml b/src/Umbraco.Core/EmbeddedResources/Lang/en_us.xml
index 2697098a712..fb57ab9ffac 100644
--- a/src/Umbraco.Core/EmbeddedResources/Lang/en_us.xml
+++ b/src/Umbraco.Core/EmbeddedResources/Lang/en_us.xml
@@ -2030,10 +2030,12 @@ To manage your website, simply open the Umbraco backoffice and start adding cont
     <key alias="event">Event</key>
     <key alias="url">Url</key>
     <key alias="types">Types</key>
     <key alias="webhookKey">Webhook key</key>
     <key alias="retryCount">Retry count</key>
+    <key alias="toggleDebug">Toggle debug mode for more information.</key>
+    <key alias="statusNotOk">Not OK status code</key>
   </area>
   <area alias="languages">
     <key alias="addLanguage">Add language</key>
     <key alias="culture">ISO code</key>
     <key alias="mandatoryLanguage">Mandatory language</key>
diff --git a/src/Umbraco.Web.BackOffice/Mapping/WebhookMapDefinition.cs b/src/Umbraco.Web.BackOffice/Mapping/WebhookMapDefinition.cs
index a7564fb6ac4..e6e7e031912 100644
--- a/src/Umbraco.Web.BackOffice/Mapping/WebhookMapDefinition.cs
+++ b/src/Umbraco.Web.BackOffice/Mapping/WebhookMapDefinition.cs
@@ -1,14 +1,25 @@
-﻿using Umbraco.Cms.Core.Mapping;
+﻿using Umbraco.Cms.Core.Hosting;
+using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Webhooks;
 using Umbraco.Cms.Web.Common.Models;
 
 namespace Umbraco.Cms.Web.BackOffice.Mapping;
 
 public class WebhookMapDefinition : IMapDefinition
 {
+    private readonly IHostingEnvironment _hostingEnvironment;
+    private readonly ILocalizedTextService _localizedTextService;
+
+    public WebhookMapDefinition(IHostingEnvironment hostingEnvironment, ILocalizedTextService localizedTextService)
+    {
+        _hostingEnvironment = hostingEnvironment;
+        _localizedTextService = localizedTextService;
+    }
+
     public void DefineMaps(IUmbracoMapper mapper)
     {
         mapper.Define<WebhookViewModel, IWebhook>((_, _) => new Webhook(string.Empty), Map);
         mapper.Define<IWebhookEvent, WebhookEventViewModel>((_, _) => new WebhookEventViewModel(), Map);
         mapper.Define<WebhookLog, WebhookLogViewModel>((_, _) => new WebhookLogViewModel(), Map);
@@ -38,15 +49,24 @@ private void Map(WebhookLog source, WebhookLogViewModel target, MapperContext co
     {
         target.Date = source.Date;
         target.EventAlias = source.EventAlias;
         target.Key = source.Key;
         target.RequestBody = source.RequestBody ?? string.Empty;
-        target.ResponseBody = source.ResponseBody;
         target.RetryCount = source.RetryCount;
-        target.StatusCode = source.StatusCode;
         target.Url = source.Url;
         target.RequestHeaders = source.RequestHeaders;
-        target.ResponseHeaders = source.ResponseHeaders;
         target.WebhookKey = source.WebhookKey;
-        target.ExceptionOccured = source.ExceptionOccured;
+
+        if (_hostingEnvironment.IsDebugMode)
+        {
+            target.ExceptionOccured = source.ExceptionOccured;
+            target.ResponseBody = source.ResponseBody;
+            target.ResponseHeaders = source.ResponseHeaders;
+            target.StatusCode = source.StatusCode;
+        }
+        else
+        {
+            target.ResponseBody = _localizedTextService.Localize("webhooks", "toggleDebug", Thread.CurrentThread.CurrentUICulture);
+            target.StatusCode = source.StatusCode is "OK (200)" ? source.StatusCode : _localizedTextService.Localize("webhooks", "statusNotOk", Thread.CurrentThread.CurrentUICulture);
+        }
     }
 }

Vulnerable code: ﻿using Umbraco.Cms.Core.Mapping;
        target.ResponseBody = source.ResponseBody;
        target.StatusCode = source.StatusCode;
        target.ResponseHeaders = source.ResponseHeaders;
        target.ExceptionOccured = source.ExceptionOccured;
Fixed code:     <key alias="toggleDebug">Skift til debug mode for mere information.</key>
    <key alias="statusNotOk">Ikke OK status kode.</key>
    <key alias="toggleDebug">Toggle debug mode for more information.</key>
    <key alias="statusNotOk">Not OK status code</key>
﻿using Umbraco.Cms.Core.Hosting;
using Umbraco.Cms.Core.Mapping;
using Umbraco.Cms.Core.Services;
    private readonly IHostingEnvironment _hostingEnvironment;
    private readonly ILocalizedTextService _localizedTextService;

    public WebhookMapDefinition(IHostingEnvironment hostingEnvironment, ILocalizedTextService localizedTextService)
    {
        _hostingEnvironment = hostingEnvironment;
        _localizedTextService = localizedTextService;
    }


        if (_hostingEnvironment.IsDebugMode)
        {
            target.ExceptionOccured = source.ExceptionOccured;
            target.ResponseBody = source.ResponseBody;
            target.ResponseHeaders = source.ResponseHeaders;
            target.StatusCode = source.StatusCode;
        }
        else
        {
            target.ResponseBody = _localizedTextService.Localize("webhooks", "toggleDebug", Thread.CurrentThread.CurrentUICulture);
            target.StatusCode = source.StatusCode is "OK (200)" ? source.StatusCode : _localizedTextService.Localize("webhooks", "statusNotOk", Thread.CurrentThread.CurrentUICulture);
        }