CVE-2024-10761: Umbraco CMS XSS Vulnerability

CVE-2024-10761 Overview

CVE-2024-10761 is a reflected cross-site scripting (XSS) vulnerability in Umbraco CMS affecting the Dashboard preview component. The flaw resides in the /Umbraco/preview/frame?id{} endpoint, where the culture parameter is reflected without proper sanitization [CWE-79]. Attackers can craft a malicious URL that executes arbitrary JavaScript in the browser of an authenticated backoffice user. The vulnerability affects Umbraco CMS versions up to 10.7.7, 12.3.6, 13.5.2, 14.3.1, and 15.1.1. Umbraco published a security advisory and released fixed versions 10.8.8, 13.5.3, 14.3.2, and 15.1.2.

Critical Impact
Exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated Umbraco backoffice session, enabling session theft, unauthorized content modification, and pivoting to administrative actions.

Affected Products

Umbraco CMS versions up to and including 10.7.7
Umbraco CMS versions 11.x through 12.3.6 and 13.x through 13.5.2
Umbraco CMS versions 14.x through 14.3.1 and 15.x through 15.1.1

Discovery Timeline

2024-11-04 - CVE-2024-10761 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10761

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Umbraco backoffice Dashboard preview component. The affected endpoint /Umbraco/preview/frame accepts an id parameter alongside a culture query parameter. The culture value is echoed back into the rendered response without sufficient output encoding, allowing an attacker to inject HTML or JavaScript payloads.

Because the vulnerable endpoint lives inside the authenticated backoffice, exploitation typically requires convincing a signed-in editor or administrator to click a crafted link. Once triggered, injected script runs with the privileges of the victim's session against the Umbraco backoffice origin.

Root Cause

The root cause is improper neutralization of input during web page generation. The culture request parameter is placed into the response markup without HTML-context or JavaScript-context encoding, satisfying the classic reflected XSS pattern documented under [CWE-79]. Any control characters, angle brackets, or quote delimiters within the parameter reach the rendered document intact.

Attack Vector

Exploitation is remote and requires no attacker authentication, though a victim with an active Umbraco backoffice session must load the crafted URL. A typical payload targets the culture parameter on /Umbraco/preview/frame?id={target}&culture=<payload>. Once the browser renders the reflected payload, the attacker's script can call backoffice APIs, exfiltrate cookies or tokens accessible to the origin, and manipulate CMS content.

Detailed technical write-ups are referenced in the Umbraco security advisory GHSA-69cg-w8vm-h229 and the VulDB entry #282930.

Detection Methods for CVE-2024-10761

Indicators of Compromise

Web server access logs containing requests to /Umbraco/preview/frame with culture parameter values including angle brackets, script, javascript:, onerror, onload, or URL-encoded equivalents (%3C, %3E)
Unusually long or base64-encoded culture parameter values that do not match valid culture identifiers such as en-US or da-DK
Backoffice sessions performing content or user modifications immediately after a preview frame request from an unusual referrer

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the culture query parameter on /Umbraco/preview/* endpoints and blocks non-alphanumeric characters beyond hyphens
Correlate authenticated backoffice request logs to identify preview frame requests followed by administrative API calls from the same session
Enable Content Security Policy (CSP) reporting on the backoffice origin to surface unexpected inline script execution attempts

Monitoring Recommendations

Ingest Umbraco IIS or Kestrel access logs into a centralized SIEM and alert on requests to /Umbraco/preview/frame containing suspicious culture values
Monitor for spikes in backoffice user activity originating from external referrers or embedded iframes
Track and alert on any changes to the IUser audit trail that immediately follow a preview endpoint request

How to Mitigate CVE-2024-10761

Immediate Actions Required

Upgrade Umbraco CMS to a fixed version: 10.8.8, 13.5.3, 14.3.2, or 15.1.2 as applicable to your branch
Restrict access to the Umbraco backoffice by IP allowlist or VPN until the patch is applied
Invalidate active backoffice sessions and rotate any API keys accessible from backoffice contexts after upgrading

Patch Information

Umbraco addressed the issue in versions 10.8.8, 13.5.3, 14.3.2, and 15.1.2. Refer to the Umbraco security advisory GHSA-69cg-w8vm-h229 for full patch notes and upgrade guidance. Sites on unsupported branches (11.x, 12.x) should migrate to a maintained branch that includes the fix.

Workarounds

Enforce a strict Content Security Policy on the backoffice that disallows inline scripts and restricts script-src to trusted origins
Configure a WAF rule to reject requests to /Umbraco/preview/frame where the culture parameter contains characters outside [A-Za-z0-9-]
Train backoffice users to avoid clicking untrusted links while authenticated to the CMS

bash

# Example WAF rule (ModSecurity) to filter malicious culture parameter values
SecRule REQUEST_URI "@beginsWith /Umbraco/preview/frame" \
  "chain,id:1010761,phase:2,deny,status:400,msg:'CVE-2024-10761 Umbraco preview XSS attempt'"
  SecRule ARGS:culture "!@rx ^[A-Za-z]{2}(-[A-Za-z]{2,4})?$" "t:none,t:urlDecodeUni"