CVE-2024-29035 (published 2024-04-17T15:15Z)

Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/umbraco/Umbraco-CMS
commit_details: repo_url: https://github.com/umbraco/Umbraco-CMS
author: Nikolaj Geisle
author_date: 2024-02-06 09:53:17+01:00
msg: Merge pull request from GHSA-74p6-39f2-23v3

* Don't display exception if not in debug mode

* Only display not OK status code in production
repository: repo_url: https://github.com/umbraco/Umbraco-CMS
repo_name: umbraco/Umbraco-CMS
description: Umbraco is a free and open source .NET content management system helping you deliver delightful digital experiences.
repo_language: C#
owner: umbraco
file_changes: filename: da.xml
change_type: ModificationType.MODIFY
diff: @@ -1015,6 +1015,8 @@
     <key alias="createHeader">Opret header</key>
     <key alias="deliveries">Leverancer</key>
     <key alias="noHeaders">Der er ikke tilføjet nogen webhook headers</key>
+    <key alias="toggleDebug">Skift til debug mode for mere information.</key>
+    <key alias="statusNotOk">Ikke OK status kode.</key>
   </area>
   <area alias="language">
     <key alias="cultureCode">Culture Code</key>

programming_language: HTML
filename: en_us.xml
change_type: ModificationType.MODIFY
diff: @@ -2032,6 +2032,8 @@ To manage your website, simply open the Umbraco backoffice and start adding cont
     <key alias="types">Types</key>
     <key alias="webhookKey">Webhook key</key>
     <key alias="retryCount">Retry count</key>
+    <key alias="toggleDebug">Toggle debug mode for more information.</key>
+    <key alias="statusNotOk">Not OK status code</key>
   </area>
   <area alias="languages">
     <key alias="addLanguage">Add language</key>

programming_language: HTML
filename: WebhookMapDefinition.cs
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,7 @@
-﻿using Umbraco.Cms.Core.Mapping;
+﻿using Umbraco.Cms.Core.Hosting;
+using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Webhooks;
 using Umbraco.Cms.Web.Common.Models;
 
@@ -7,6 +9,15 @@ namespace Umbraco.Cms.Web.BackOffice.Mapping;
 
 public class WebhookMapDefinition : IMapDefinition
 {
+    private readonly IHostingEnvironment _hostingEnvironment;
+    private readonly ILocalizedTextService _localizedTextService;
+
+    public WebhookMapDefinition(IHostingEnvironment hostingEnvironment, ILocalizedTextService localizedTextService)
+    {
+        _hostingEnvironment = hostingEnvironment;
+        _localizedTextService = localizedTextService;
+    }
+
     public void DefineMaps(IUmbracoMapper mapper)
     {
         mapper.Define<WebhookViewModel, IWebhook>((_, _) => new Webhook(string.Empty), Map);
@@ -40,13 +51,22 @@ private void Map(WebhookLog source, WebhookLogViewModel target, MapperContext co
         target.EventAlias = source.EventAlias;
         target.Key = source.Key;
         target.RequestBody = source.RequestBody ?? string.Empty;
-        target.ResponseBody = source.ResponseBody;
         target.RetryCount = source.RetryCount;
-        target.StatusCode = source.StatusCode;
         target.Url = source.Url;
         target.RequestHeaders = source.RequestHeaders;
-        target.ResponseHeaders = source.ResponseHeaders;
         target.WebhookKey = source.WebhookKey;
-        target.ExceptionOccured = source.ExceptionOccured;
+
+        if (_hostingEnvironment.IsDebugMode)
+        {
+            target.ExceptionOccured = source.ExceptionOccured;
+            target.ResponseBody = source.ResponseBody;
+            target.ResponseHeaders = source.ResponseHeaders;
+            target.StatusCode = source.StatusCode;
+        }
+        else
+        {
+            target.ResponseBody = _localizedTextService.Localize("webhooks", "toggleDebug", Thread.CurrentThread.CurrentUICulture);
+            target.StatusCode = source.StatusCode is "OK (200)" ? source.StatusCode : _localizedTextService.Localize("webhooks", "statusNotOk", Thread.CurrentThread.CurrentUICulture);
+        }
     }
 }

programming_language: C#