Security Bulletin SC2020-002-293863


The information on the latest update

Description

This article reports Medium vulnerability (SC2020-002-293863) in Sitecore software, for which there is a fix available.

This relates to the previously disclosed Critical vulnerability (SC2019-002-312864) in Sitecore software, for which a fix was made available in March 2019.

Medium vulnerability SC2020-002-293863 allows an authenticated threat actor to inject malicious commands and code, thus compromising the security controls (CVE-2019-9875) .

We encourage Sitecore customers and partners to familiarize themselves with the information below and apply the fix to all Sitecore systems. In the event that customers are unable to apply the Solution immediately, Sitecore suggests that customers apply the Alternative Workaround in the interim and identify a way to apply the Solution.

If you want to receive notifications about new Security Bulletins on the Sitecore Knowledge Base, subscribe to security updates: KB1000489.

Severity Definitions

To help customers and partners understand the severity of potential security vulnerabilities, Sitecore uses the definitions from Severity Definitions for Security Vulnerabilities to report security issues.

Versions

Versions affected

Vulnerability SC2020-002-293863 affects the following Sitecore XP versions:

This includes CMS-only and xDB-enabled modes, single-instance and multi-instance environments, Managed Cloud environments, and all Sitecore server roles (content delivery, content editing, reporting, processing, publishing, etc.).

A hotfix is available for all affected Sitecore XP versions.

Versions not affected

Important note!

Sitecore XP 8.2 and earlier versions are affected by the related Critical vulnerability SC2019-002-312864. Sitecore recommends immediately applying a fix for Critical vulnerability SC2019-002-312864 which is documented in Security Bulletin SC2019-002-312864

Solution

Install the hotfix by performing the following steps:

  1. Download the Sitecore.Xaml.AntiCsrf.config file and copy it to the \App_Config\Include\zzz folder.
    Note: the configuration patch completely removes the original <rule name="xaml-controls"> node from the \App_Config\Sitecore\AntiCSRFModule\Sitecore.AntiCsrf.config and \App_Config\Sitecore\Marketing.Xdb.MarketingAutomation.Tracking\Sitecore.Xdb.MarketingAutomation.Tracking.config files, and adds a "xaml-controls" rule split into two replacing the initial one.
  2. Install the following hotfix via Package Installation Wizard: SC Hotfix 313001-2 Security.AntiCsrf 1.1.1.zip.
  3. This hotfix replaces existing files. When asked what to do, allow the installation wizard to overwrite the existing files.

To verify that the fix has been applied successfully, check the "Product version" property of the Sitecore.Security.AntiCsrf.dll assembly. It should be "1.1.1-r00011-e000b86 Hofix 313001-1".

Alternative Workaround

If a full solution cannot be applied right away, the following temporary workaround can be used on all affected Sitecore instances to secure them from the vulnerability.

To temporarily address the vulnerability, deny access to the \Website\sitecore\shell folder on all Sitecore instances in all your Sitecore environments.

  1. Go to your Sitecore web application in the Internet Information Services (IIS) Manager application.
  2. Select \sitecore\shell folder.
  3. Click the .NET Authorization Rules:
  4. Click Add Deny Rule… in the Actions panel:
  5. Select All users and OK:

Note: After implementing this workaround, content editing functionality is not available in your Sitecore environments.

If the content editing functionality cannot be temporarily disabled, as an alternative, it is possible to configure IP-based security restrictions for \Website\sitecore\shell folder to block all access for external users and only allow access from the trusted IP addresses that a malicious actor is not able to use. For instructions on how to configure IP-based security restrictions, see here.

History of updates