Hardening against CSV Injection in Umbraco

Hello, long time no blog. It has certainly been a while but I am still doing penetration testing. Some say I am wasting my potential by not going up the corporate ladder but we spend 40+ hours at work. I at least want some of it to be fun without having to manage the human part.

Let my -isms fly free.

Recently, I did a penetration test on Umbraco. Doing testing on these kinds of products is fun because of the high reward low risk. If I find nothing, I can just say that is has been tested a million times. But if I do find something… wow thats sick.

During this penetration test, I did manage to find XSS and CSV injection. My XSS was rejected for a CVE the first time around but I managed to replicate it on the latest version of Umbraco (18.1.0) and I'm certain I haven't gone delulu. I'll write a blog about that depending on the outcome from their security team.

The CSV injection vulnerability isn't really a CVE because it is more of a misconfiguration. Also its just a cheap sucker punch of a vulnerability that doesn't mean much given the basic endpoint protection most computers have these days.

Nevertheless, this is something that does come up on security reports and it's a pain to fix. For Umbraco, it is more of a misconfiguration.

The rest of this blog is just a screenshot walkthrough of my proof of concept and then the hardening settings to apply to prevent it in the future.

Walkthrough Proof Of Concept

Hardening Umbraco against CSV injection

The fix for CSV injection is server side validation and you can do that for short and long answers in Umbraco's text inputs.

^(?!\s[=+-@]).**

Testing it one more time through a classic bypass

For the other types of inputs, the validation process is different where you need to blacklist a bunch of starting inputs. Its a bit of a pain but it will close the issue.

If you made it this far. Thanks for reading. Until next time!