https://umbraco.com/blog/security-advisory-patch-for-your-site-is-now-available/

Just as an FYI: the new Umbraco versions we're pushing out now contain nothing at all new, only the updated CDF version so that people who do fresh installs are safe by default.

Hi, I have an Umbraco 7.3.8 website where Umbraco does not work (white screen) after replacing the ClientDependency.Core.dll file (Console gives SyntaxError in a JS file). I have cleared the caches in App_Data and have checked the dll is for the correct .NET version. If I restore the old version, everything works fine again. Any ideas how to fix this?

Is the security issue itself only relevant to environments running .NET 3.5? Regarding this commit: https://github.com/Shazwazza/ClientDependency/commit/d353cc1369e052ab2dfb06bbf3c0eabcb1124dde#diff-74b40b5893da1f6bb4bdd4713b769464

We are manual patching, we have a couple of sites built on 4.5.2, will the 4.5 patch work as expected?

Thanks

FYI: Umbraco releases 7.10.5, 7.11.2 and 7.12.3 are now available for download and the only change from 7.10.4, 7.11.1 and 7.12.2 is that the version of CDF has been updated.

7.12.3 is now the recommended release for starting new projects with.

Hi Seb,

The advisory states:

"The vulnerability is exploitable by any unauthenticated user requesting resources from your public website, a vulnerability of type “Local File Inclusion”. The resources that can be requested includes configuration files and other sensitive internal files not intended for public access."

Could this potentially be any configuration file, including the web.config?

I'm just trying to gage how potentially serious this could be so as to know what resources to allocate (we host a lot of Umbraco sites, so this will be a big job for us).

We want to deploy the security patch on all of our websites, without opening them in Visual Studio (we want to do that later).

How can I tell on a deployed website which version on .NET it uses? I can see which version of Umbraco it uses in the web.config. Where can I find the .NET version?

I know of targetframeworkversion in csproj, but that file is not present. Thanks

Hi, We've done the patch to our sites okay but are having a problem updating our local development instances via Nuget. It appears CDF 1.9.7 is not compatible with ClientDependency-Mvc5 1.8.0 (which we use) and I can't seem to select a lower version of ClientDependency-Mvc5 to around this impass. Here's the Nuget error: Update-Package : Unable to resolve dependencies. 'ClientDependency 1.9.7' is not compatible with 'ClientDependency-Mvc5 1.8.0 constraint: ClientDependency (>= 1.8.0)', 'UmbracoCms.Core 7.12.3 constraint: ClientDependency (>= 1.9.7 && < 2.0.0)'. At line:1 char:1 + Update-Package ClientDependency -Version 1.9.7

Sorry, its all good. Ensure you delete your files from /App_Data/Temp/ClientDependency folder before doing this in Visual Studio.

This patch upgrade is not needed for 7.2.x -7.10.4 right?

3 down 136 to go here.

Here's a tool that will list all Umbraco websites under a particular folder and allow you to apply the patch individually with a few keystrokes:

https://github.com/emanuelgaspar/UmbracoPatch20180920

You could change it to run automatically for all websites it finds after a few tests.

Hope it helps.

Just wanna thank HQ for the professional approach in the way the found security issue has been addressed!

Awesome job guys!

1141 from 1141 Umbraco installations Updated!

Hi Sebastiaan,

the issue is somewhere in the ClientDependency and as far as I know ClientDependency is only used in /Umbraco/.

We lock all our /umbraco/-paths on IP-address. Would it safe to say, that it wouldn't impact our websites?

Regards, Jeffrey

Hey Seb,

Small q, we are hosting most of our sites on azure with the setting

<add key="umbracoLocalTempStorage" value="EnvironmentTemp" />

So there is no ~/AppData/ClientDependency or ~/AppData/Temp/ClientDependency folder... is there anything else we need to clear in this case?

I'm curious about forensic options for determining if a site has been exploited. Would it be true to assume that if a site's web.config was compromised we'd be able to find the contents of the web.config in one of ClientDependency temp files?

Thanks y'all! Moving all of my sites to a single instance of Umbraco last year just paid off.

I appreciate that you take the effort to proactively deal with security issues.

Keep up the good work!

Timothy

Hi,

I've run into a backoffice whitescreen issue after performing the update. Framework version 4.5, Umbraco 7.2.1.

A single CDF related message is generated in the log file:

2018-09-21 10:33:47,183 [101] ERROR Umbraco.Web.UI.CdfLogger - [Thread 102] Could not load file contents from /umbraco/developer/RelationTypes/TreeMenu/ActionNewRelationType.js. EXCEPTION: This operation is not supported for a relative URI.
System.InvalidOperationException: This operation is not supported for a relative URI.
   at System.Uri.get_PathAndQuery()
   at ClientDependency.Core.CompositeFiles.Providers.BaseCompositeFileProcessingProvider.WritePathToStream(ClientDependencyType type, String path, HttpContextBase context, StreamWriter sw)

EDIT: Only difference so far between this and our other sites is that this is one of the only ones that has the Umbraco backoffice URL changed. Maybe this is related?

Hi all,

I am having .Net 4.5. Just wanted to confirm the steps if I am manually applying for security patch.

In local .Net project

1. I copied ClientDependency.Core.dll file in bin folder
2. Added reference to above file
3. deleted file in \App_Data\TEMP\ClientDependency folder
4. build and run

On live project,

1. just updated ClientDependency.Core.dll and project dll

Hi Sebastiaan,

We upgraded a 7.2.6 site using the nuget update method, but it also modified the web.config by replacing this line:

<clientDependency configSource="config\ClientDependency.config" />

with this:

  <clientDependency version="1">
    <!-- Full config documentation is here: https://github.com/Shazwazza/ClientDependency/wiki/Configuration -->
  </clientDependency>

Also this was added to the <pages> section:

  <namespaces>
    <add namespace="ClientDependency.Core" />
  </namespaces>

Also the verb changed from * to GET on this line inside <httpHandlers>:

<add verb="*" path="DependencyHandler.axd" ... />

And these lines got added into <handlers> :

 <remove name="DependencyHandler" />
 <add name="DependencyHandler" preCondition="integratedMode" verb="GET" path="DependencyHandler.axd" type="ClientDependency.Core.CompositeFiles.CompositeDependencyHandler, ClientDependency.Core " />

Are these changes expected? Or should we roll them back?

Thanks, Andy

As an FYI to anyone who may come across this issue whilst installing the new update via NuGet, the install added the following to my web.config file, which caused the site to fail.

<dependentAssembly>
    <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
    <bindingRedirect oldVersion="0.0.0.0-4.1.2.0" newVersion="4.1.2.0" />
  </dependentAssembly>
  <dependentAssembly>
    <assemblyIdentity name="System.IO" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
    <bindingRedirect oldVersion="0.0.0.0-4.1.2.0" newVersion="4.1.2.0" />
  </dependentAssembly>

All I had to do was remove it again from the web.config file and all was well again.

If we have extra class library projects in our solution, will we need to update the Client Dependency for them also?

Hi all

We have a problem with Newsletter Studio after updating ClientDependencyCore.dll

We have tried updating newsletter studio to latest version also.

When we open the module we get the following error in console, and the module does not work.

Error: Argument 'NewsletterStudio.Dashboards.NewsletterMainDashboardController' is not a function, got undefined

Anyone got an idea on how to solve this problem?

Hi, I just updated the client dependency manually using the 4.5 framework. For some reason I cannot get into the back end admin console now. Are there any known issues updating manually that would have caused this? when I go to the site/umbraco the backend page does not even load.

is working on a reply...