U4-10497 - XSS Vulnerability in page name

Thanks, we were already working on a fix for this coming soon.

Great! Thanks for the update @sebastiaan

Fixed in https://github.com/umbraco/Umbraco-CMS/commit/fe2b86b681455ac975b294652064b2718d4e2ba2

Classified as medium priority. A malicious editor can perform a XSS attack on other users in the system provided the other user uses the right-click > Publish or the right-click > notifications menu items.

If you're really concerned about this on a older versions of Umbraco you can place the attached four files in ~/Umbraco/Dialogs/ - these are just the newest versions of notifications.aspx.cs and Publish.aspx.cs with the aspx files next to them pointing to the CodeFile instead of to CodeBehind. This means that the asp.cs file in the ~/Umbraco/Dialogs/ folder will be used instead of the CodeBehind built into the Umbraco dlls (built against Umbraco 7.0.0 and tested on v7.3.0 - should work in all versions though).

FYI: A different way to work around this issue on older versions of Umbraco (all the way down to 7.0.0) would be to have an ApplicationEventHandler (https://our.umbraco.org/documentation/Getting-Started/Code/Subscribing-To-Events/) that hooks into the Saving event. It should HtmlEncode the names of all nodes.

Something like this should do the trick (can be dropped into App_Code):

using Umbraco.Core; using Umbraco.Core.Services; using System.Web;

namespace U4_10497 { public class NodeNameSafeEventHandler: ApplicationEventHandler { protected override void ApplicationStarted(UmbracoApplicationBase umbracoApplication, ApplicationContext applicationContext) { ContentService.Saving += ContentService_Saving; MediaService.Saving += MediaService_Saving; }

    private void MediaService_Saving(IMediaService sender, Umbraco.Core.Events.SaveEventArgs<Umbraco.Core.Models.IMedia> e)
    {
        foreach (var mediaItem in e.SavedEntities)
        {
            //first decode to prevent double encoding
            var title = HttpContext.Current.Server.HtmlDecode(mediaItem.Name);
            mediaItem.Name = HttpContext.Current.Server.HtmlEncode(title);
        }
    }

    private void ContentService_Saving(IContentService sender, Umbraco.Core.Events.SaveEventArgs<Umbraco.Core.Models.IContent> e)
    {
        foreach (var content in e.SavedEntities)
        {
            //first decode to prevent double encoding
            var title = HttpContext.Current.Server.HtmlDecode(content.Name);
            content.Name = HttpContext.Current.Server.HtmlEncode(title);
        }
    }
}

}