CVE-2023-37267: Umbraco CMS Auth Bypass Vulnerability

CVE-2023-37267 Overview

CVE-2023-37267 is an authentication bypass vulnerability in Umbraco CMS, a popular open-source ASP.NET content management system. Under rare conditions during a restart of Umbraco, unauthorized users can gain access to admin-level permissions. This vulnerability affects the runtime state handling mechanism and allows attackers to potentially take complete control of affected Umbraco installations.

Critical Impact

Unauthorized users can obtain administrative access to Umbraco CMS during system restarts, potentially leading to complete compromise of the web application and underlying data.

Affected Products

• Umbraco CMS versions prior to 10.6.1
• Umbraco CMS versions 11.x prior to 11.4.2
• Umbraco CMS versions 12.x prior to 12.0.1

Discovery Timeline

• July 13, 2023 - CVE-2023-37267 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-37267

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) in Umbraco's runtime state management. When Umbraco CMS restarts under certain rare conditions, the system fails to properly enforce authentication and authorization controls, allowing unauthorized users to access administrative functionality. The vulnerability exists in the RuntimeState.cs component, which handles the application's runtime level determination during startup sequences.

The flaw occurs when the system detects a configured but missing database scenario. In vulnerable versions, the runtime level was incorrectly set to RuntimeLevel.Install, which exposes the installation wizard and administrative interfaces without proper authentication. This creates a window of opportunity during restarts where an attacker monitoring the application could gain elevated privileges.

Root Cause

The root cause lies in the RuntimeState.cs file where the runtime level was improperly set to RuntimeLevel.Install when a database was configured but missing. This incorrect state transition exposed installation endpoints that should only be accessible during initial setup, effectively bypassing the authentication requirements for administrative access.

Attack Vector

An attacker can exploit this vulnerability by monitoring a target Umbraco CMS instance and waiting for or inducing a restart condition. When the application restarts and encounters the specific database state that triggers the vulnerability, the attacker can access the installation wizard endpoints without authentication. From there, they can potentially reconfigure the system, create new administrative accounts, or execute arbitrary code through administrative features.

// Vulnerable code in RuntimeState.cs - Before patch
if (_globalSettings.Value.InstallMissingDatabase || _databaseProviderMetadata.CanForceCreateDatabase(_databaseFactory))
{
    // ok to install on a configured but missing database
    Level = RuntimeLevel.Install;  // VULNERABLE: Exposes install endpoints
    Reason = RuntimeLevelReason.InstallMissingDatabase;
    return;
}

Source: Umbraco CMS Security Commit

// Patched code in RuntimeState.cs - After fix
if (_globalSettings.Value.InstallMissingDatabase || _databaseProviderMetadata.CanForceCreateDatabase(_databaseFactory))
{
    // ok to install on a configured but missing database
    Level = RuntimeLevel.BootFailed;  // FIXED: Application fails safely
    Reason = RuntimeLevelReason.InstallMissingDatabase;
    return;
}

Source: Umbraco CMS Security Commit

Detection Methods for CVE-2023-37267

Indicators of Compromise

• Unexpected access to the Umbraco installation wizard (/install/) endpoints on production systems
• Authentication logs showing successful administrative access without corresponding login events
• New administrative user accounts created during system restart periods
• Unusual activity in Umbraco backoffice immediately following application restarts

Detection Strategies

• Monitor web server logs for requests to /install/ and /umbraco/install/ endpoints on production systems
• Implement alerting on Umbraco administrative account creation events
• Review IIS or Kestrel application restart logs and correlate with authentication events
• Deploy web application firewall rules to detect and alert on installation wizard access attempts

Monitoring Recommendations

• Configure real-time monitoring for application pool recycling and restart events
• Implement integrity monitoring on Umbraco configuration files and user database tables
• Set up alerts for any access to installation-related endpoints during normal operation
• Review and audit administrative user accounts regularly for unauthorized additions

How to Mitigate CVE-2023-37267

Immediate Actions Required

• Upgrade Umbraco CMS to patched versions: 10.6.1, 11.4.2, or 12.0.1 immediately
• Review administrative user accounts for any unauthorized additions
• Check audit logs for suspicious activity during any recent restart events
• Restrict network access to Umbraco administrative endpoints where possible

Patch Information

Umbraco has released security patches across multiple supported versions. The fix changes the runtime level from RuntimeLevel.Install to RuntimeLevel.BootFailed when a configured but missing database is detected, preventing the exposure of installation endpoints. Organizations should update to the following patched versions:

• Version 10.x: Update to 10.6.1 or later
• Version 11.x: Update to 11.4.2 or later
• Version 12.x: Update to 12.0.1 or later

For detailed patch information, refer to the GitHub Security Advisory GHSA-h8wc-r4jh-mg7m.

Workarounds

• Implement network-level restrictions to block external access to installation endpoints (/install/, /umbraco/install/)
• Configure web server rules to deny requests to installation wizard URLs in production environments
• Use a web application firewall to block access to sensitive Umbraco administrative paths
• Consider implementing IP whitelisting for Umbraco backoffice access until patches can be applied

# IIS URL Rewrite rule to block installation endpoint access
# Add to web.config in the <system.webServer><rewrite><rules> section
<rule name="Block Install Endpoint" stopProcessing="true">
    <match url="^install/?" />
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Access Denied" />
</rule>