CVE-2024-35218 (C#, published 2024-05-21T14:15Z)
Description: value: Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.





Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Core/DependencyInjection/UmbracoBuilder.cs
src/Umbraco.Core/PropertyEditors/MarkDownPropertyValueEditor.cs
src/Umbraco.Core/PropertyEditors/MarkdownPropertyEditor.cs
src/Umbraco.Core/Security/IMarkdownSanitizer.cs
src/Umbraco.Core/Security/NoopMarkdownSanitizer.cs
Commit message: Merge pull request from GHSA-gvpc-3pj6-4m9w

* Add MarkDownPropertyValueEditor with html sanitizer

* Implement IMarkdownSanitizer.

Vulnerable code:
            // Register a noop IHtmlSanitizer to be replaced

Fixed code:
            // Register a noop IHtmlSanitizer & IMarkdownSanitizer to be replaced
            Services.AddUnique<IMarkdownSanitizer, NoopMarkdownSanitizer>();
﻿using Umbraco.Cms.Core.IO;
using Umbraco.Cms.Core.Models.Editors;
using Umbraco.Cms.Core.Security;
using Umbraco.Cms.Core.Serialization;
using Umbraco.Cms.Core.Services;
using Umbraco.Cms.Core.Strings;
using Umbraco.Extensions;

namespace Umbraco.Cms.Core.PropertyEditors;

/// <summary>
///     A custom value editor to ensure that macro syntax is parsed when being persisted and formatted correctly for
///     display in the editor
/// </summary>
internal class MarkDownPropertyValueEditor : DataValueEditor
{
    private readonly IMarkdownSanitizer _markdownSanitizer;

    public MarkDownPropertyValueEditor(
        ILocalizedTextService localizedTextService,
        IShortStringHelper shortStringHelper,
        IJsonSerializer jsonSerializer,
        IIOHelper ioHelper,
        DataEditorAttribute attribute,
        IMarkdownSanitizer markdownSanitizer)
        : base(localizedTextService, shortStringHelper, jsonSerializer, ioHelper, attribute) => _markdownSanitizer = markdownSanitizer;

    public override object? FromEditor(ContentPropertyData editorValue, object? currentValue)
    {
        if (string.IsNullOrWhiteSpace(editorValue.Value?.ToString()))
        {
            return null;
        }

        var sanitized = _markdownSanitizer.Sanitize(editorValue.Value.ToString()!);

        return sanitized.NullOrWhiteSpaceAsNull();
    }
}
using Umbraco.Cms.Core.Models;

    /// <summary>
    ///     Create a custom value editor
    /// </summary>
    /// <returns></returns>
    protected override IDataValueEditor CreateValueEditor() =>
        DataValueEditorFactory.Create<MarkDownPropertyValueEditor>(Attribute!);
﻿namespace Umbraco.Cms.Core.Security;

/// <summary>
/// Sanitizer service for the markdown editor.
/// </summary>
public interface IMarkdownSanitizer
{
    /// <summary>
    ///     Sanitizes Markdown
    /// </summary>
    /// <param name="markdown">Markdown to be sanitized</param>
    /// <returns>Sanitized Markdown</returns>
    string Sanitize(string markdown);
}
﻿namespace Umbraco.Cms.Core.Security;

/// <inheritdoc />
public class NoopMarkdownSanitizer : IMarkdownSanitizer
{
    /// <inheritdoc />
    public string Sanitize(string markdown) => markdown;
}