CVE-2021-37334: Umbraco Forms RCE Vulnerability

CVE-2021-37334 Overview

CVE-2021-37334 is a critical Remote Code Execution (RCE) vulnerability affecting Umbraco Forms, a popular form builder component for the Umbraco CMS platform. The vulnerability exists due to improper file extension validation during the file upload process, where validation occurs after the file has already been stored in a temporary directory. This timing flaw allows attackers to upload malicious files and execute arbitrary code on the server.

The vulnerability is particularly severe because attackers can bypass the default access restrictions by uploading a specially crafted web.config file to the temporary directory, effectively overriding security constraints and enabling the execution of uploaded script files.

Critical Impact

Unauthenticated attackers can achieve remote code execution by uploading malicious script files, potentially leading to complete server compromise, data theft, and arbitrary file deletion.

Affected Products

• Umbraco Forms version 4.0.0 up to and including 8.7.5
• Umbraco Forms all versions below 4.0.0 in the 4.x branch
• All Umbraco CMS installations utilizing vulnerable Forms component versions

Discovery Timeline

• 2021-07-20 - Umbraco releases security patch
• 2021-08-25 - CVE-2021-37334 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-37334

Vulnerability Analysis

This vulnerability represents a classic Time-of-Check Time-of-Use (TOCTOU) flaw combined with an unrestricted file upload weakness. The core issue stems from the order of operations during file upload handling in Umbraco Forms. When a user submits a form containing file attachments, the application first stores the uploaded file in a temporary directory located at %BASEDIR%/APP_DATA/TEMP/FileUploads/ before performing any validation on the file extension or content.

While the application relies on the root web.config file to restrict access to the temporary upload directory, this security mechanism can be circumvented. An attacker can exploit this by uploading a custom web.config file to the temporary directory that removes these access restrictions, followed by uploading a malicious script file such as an ASPX webshell.

Root Cause

The root cause lies in the improper sequencing of security controls in the file upload workflow. File extension validation should occur before the file is written to any storage location, not after. By validating extensions post-storage, the application creates a window of opportunity where malicious files exist on the filesystem and can potentially be accessed or executed.

Additionally, the reliance on directory-level web.config inheritance for access control proves insufficient when attackers can introduce their own configuration files that override the parent restrictions.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a form with file upload functionality on a vulnerable Umbraco installation
2. Crafting a malicious web.config file that permits script execution and removes access restrictions
3. Uploading the malicious web.config to the temporary upload directory
4. Uploading a webshell or malicious ASPX script file to the same directory
5. Directly accessing the uploaded script file via HTTP to achieve code execution

The exploitation does not require any special privileges, making it accessible to anonymous internet users targeting publicly accessible Umbraco installations.

Detection Methods for CVE-2021-37334

Indicators of Compromise

• Suspicious files in the APP_DATA/TEMP/FileUploads/ directory, particularly .aspx, .asp, .ashx, or web.config files
• Unexpected HTTP requests to paths containing /APP_DATA/TEMP/FileUploads/
• Web server processes spawning unusual child processes (cmd.exe, powershell.exe)
• New or modified web.config files in non-standard directories
• IIS worker process (w3wp.exe) executing system commands or network connections

Detection Strategies

• Monitor file system activity in the Umbraco application directory for creation of executable script files or web.config modifications
• Implement web application firewall (WAF) rules to detect and block file uploads containing web.config or server-side script extensions
• Configure endpoint detection to alert on IIS application pool processes spawning shells or command interpreters
• Analyze HTTP access logs for requests targeting temporary upload directories

Monitoring Recommendations

• Enable detailed file system auditing on the Umbraco installation directories, particularly the APP_DATA folder hierarchy
• Configure real-time monitoring for process creation events from IIS worker processes
• Deploy log aggregation and correlation to identify multi-stage exploitation attempts
• Implement integrity monitoring on critical application configuration files

How to Mitigate CVE-2021-37334

Immediate Actions Required

• Upgrade Umbraco Forms to the latest patched version immediately
• Audit the APP_DATA/TEMP/FileUploads/ directory for any suspicious or unexpected files
• Review web server logs for evidence of exploitation attempts
• Implement network segmentation to limit outbound connectivity from web servers
• Consider temporarily disabling file upload functionality on forms if immediate patching is not possible

Patch Information

Umbraco released security patches on July 20, 2021, addressing this vulnerability. Organizations should upgrade to the patched versions as documented in the Umbraco Security Advisory. Additional pre-release information was provided in the Umbraco Forms Security Patch Advisory.

Workarounds

• Restrict access to the temporary upload directory via IIS configuration at the server level rather than relying solely on web.config
• Configure handler mappings to prevent execution of scripts in upload directories
• Implement strict file type whitelisting at the web server level for the upload paths
• Use a WAF to block requests containing potentially malicious file extensions destined for upload endpoints

# IIS configuration to deny script execution in upload directories
# Add to applicationHost.config or use IIS Manager
# Location: %windir%\system32\inetsrv\config\applicationHost.config

# Example PowerShell to restrict handler mappings for the upload directory
# Remove script handlers from specific paths
Remove-WebHandler -Name "ExtensionlessUrlHandler-ISAPI-4.0_64bit" -Location "Default Web Site/APP_DATA"
Remove-WebHandler -Name "ASPClassic" -Location "Default Web Site/APP_DATA"
Set-WebConfigurationProperty -Filter "system.webServer/handlers" -Location "Default Web Site/APP_DATA" -Name "accessPolicy" -Value "Read"