Prevent server path disclosure from Media PostSave endpoint #14851
shearer3000
started this conversation in
Features and ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
A security penetration test of a client website has reported that the Media upload (PostSave endpoint) can make potentially sensitive information known.
{ "ExceptionMessage": "Access to the path '<our server path removed here>\\umbraco\\Data\\TEMP\\FileUploads' is denied.", "ExceptionType": null, "StackTrace": null }
In this case, this error was raised when trying to upload an Eicar test file https://www.eicar.org/download-anti-malware-testfile/
Can Umbraco not return technical information ("ExceptionMessage") to the browser?
NB This for an environment where Umbraco is configured in production mode:
"CMS": { "Runtime": { "Mode": "Production" },
Beta Was this translation helpful? Give feedback.
All reactions