CVE-2021-47776: 
C# vulnerability analysis and mitigation

CVE-2021-47776 is a Server-Side Request Forgery (SSRF) vulnerability in Umbraco CMS v8.14.1 that allows unauthenticated attackers to manipulate baseUrl parameters across multiple dashboard and help controller endpoints. The affected endpoints include GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss, which can be abused to trigger unauthorized server-side requests to external or internal hosts. The CVE was assigned by VulnCheck and published to the NVD on January 15, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the web server retrieves the contents of a URL supplied by an upstream component without sufficiently validating that the request targets an expected destination. Specifically, Umbraco CMS v8.14.1 fails to sanitize or restrict the baseUrl parameter accepted by the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints, allowing an attacker to supply arbitrary URLs. No authentication, user interaction, or special preconditions are required — the vulnerability is exploitable remotely with low attack complexity. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB, GitHub Advisory).

Successful exploitation allows an attacker to cause the Umbraco server to issue HTTP requests to attacker-controlled or internal network destinations, potentially exposing internal services, cloud metadata endpoints, or backend systems not otherwise accessible from the internet. The primary impact is on integrity (unauthorized server-side actions) with secondary risks to confidentiality of internal infrastructure via SSRF-based enumeration. Availability of the vulnerable system itself is not directly impacted, but the vulnerability could facilitate lateral movement within internal networks or be chained with other vulnerabilities (GitHub Advisory, Feedly).

A public proof-of-concept exploit is available on Exploit-DB (exploit #50462), making this vulnerability accessible to a broad range of threat actors (Exploit-DB). As of the time of publication, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.026% (4th percentile), indicating a low but non-zero probability of exploitation in the near term (GitHub Advisory). No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Umbraco CMS instances running version 8.14.1 using tools like Shodan, Censys, or web application fingerprinting techniques targeting Umbraco-specific paths and headers.
2. Identify vulnerable endpoints: Locate the SSRF-susceptible endpoints: /umbraco/backoffice/UmbracoApi/Dashboard/GetRemoteDashboardContent, /umbraco/backoffice/UmbracoApi/Dashboard/GetRemoteDashboardCss, and /umbraco/backoffice/UmbracoApi/HelpPage/GetContextHelpForPage.
3. Craft malicious request: Send an HTTP GET or POST request to one of the vulnerable endpoints, supplying an attacker-controlled URL as the baseUrl parameter (e.g., baseUrl=http://169.254.169.254/latest/meta-data/ for cloud metadata or baseUrl=http://internal-host/).
4. Trigger SSRF: The Umbraco server processes the request and fetches the attacker-specified URL server-side, potentially returning internal resource content in the HTTP response or confirming reachability of internal hosts.
5. Enumerate internal resources: Iterate over internal IP ranges, ports, or cloud metadata paths to map internal network topology or extract sensitive configuration data (Exploit-DB, GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the Umbraco application server to unexpected external hosts, internal IP ranges (RFC 1918), or cloud metadata endpoints (e.g., 169.254.169.254).
• Logs: Web server or application logs showing requests to /umbraco/backoffice/UmbracoApi/Dashboard/GetRemoteDashboardContent, GetRemoteDashboardCss, or HelpPage/GetContextHelpForPage with unusual or external baseUrl parameter values.
• Network: DNS queries or HTTP connections originating from the Umbraco server process to domains or IPs not associated with normal Umbraco update/help functionality.
• Logs: Repeated or automated requests to the above endpoints from a single source IP, potentially indicating scanning or exploitation attempts.

Organizations should upgrade Umbraco CMS from version 8.14.1 to a patched release; consult the Umbraco releases page for the latest fixed version. As interim mitigations, implement network egress filtering to restrict outbound HTTP requests from the application server to only necessary external hosts, and deploy Web Application Firewall (WAF) rules to block or sanitize baseUrl parameter manipulation on the affected endpoints. Monitoring for suspicious requests to GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss is also recommended (GitHub Advisory, Feedly).