CVE-2024-32872 Umbraco Workflow's Backoffice users can execute arbitrary SQL
Authenticated Backoffice users can execute arbitrary SQL queries via a vulnerable API endpoint in the Umbraco Workflow plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32872?
CVE-2024-32872 is a medium-severity SQL injection vulnerability in Umbraco.Workflow.Issues, published on 24 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.
Weakness: CWE-89
Which versions are affected by CVE-2024-32872?
8 open source packages ship an affected version, including Umbraco.Workflow and Plumber.Workflow.
| Package | Affected | Fixed in |
|---|---|---|
Umbraco.Workflow NuGet | All versions | 10.3.9 |
Umbraco.Workflow NuGet | All versions | 10.3.9 |
Umbraco.Workflow NuGet | From 11.0.0-rc1 | 12.2.6 |
Umbraco.Workflow NuGet | From 11.0.0-rc1 | 12.2.6 |
Umbraco.Workflow NuGet | From 13.0.0-rc1 | 13.0.6 |
Umbraco.Workflow NuGet | From 13.0.0-rc1 | 13.0.6 |
2 more packages
Plumber.Workflow NuGet | All versions | 10.1.2 |
Plumber.Workflow NuGet | All versions | 10.1.2 |
How do I fix CVE-2024-32872?
Upgrade Umbraco.Workflow to a fixed version for your release line: 10.3.9, 12.2.6 or 13.0.6.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-32872 being exploited?
There is no known exploitation of CVE-2024-32872 in the wild and no public exploit code.
Sources
Also known as GHSA-287f-46j7-j4wh.