Analyze security configuration in Umbraco projects
Analyzes Umbraco projects for security vulnerabilities in API exposure, credentials, and configuration.
/plugin marketplace add twofoldtech-dakota/claude-marketplace/plugin install twofoldtech-dakota-umbraco-analyzer-plugins-umbraco-analyzer@twofoldtech-dakota/claude-marketplaceIdentify security vulnerabilities, API exposure, and credential issues.
Check Content Delivery API configuration:
// Bad: Publicly accessible
{
"Umbraco": {
"CMS": {
"DeliveryApi": {
"Enabled": true,
"PublicAccess": true // No authentication!
}
}
}
}
// Good: Protected
{
"Umbraco": {
"CMS": {
"DeliveryApi": {
"Enabled": true,
"PublicAccess": false,
"ApiKey": "your-secure-key"
}
}
}
}
Search for credentials in code and config:
// Bad: Hardcoded
private const string ApiKey = "sk-1234567890";
private const string ConnectionString = "Server=...;Password=secret";
// Good: Configuration
private readonly string _apiKey;
public MyService(IConfiguration config)
{
_apiKey = config["ExternalApi:Key"];
}
Check for IP restrictions:
// Good: IP whitelist for backoffice
{
"Umbraco": {
"CMS": {
"Security": {
"AllowedIPs": ["10.0.0.0/24", "192.168.1.100"]
}
}
}
}
Check for overly permissive CORS:
// Bad: Allow all origins
builder.Services.AddCors(options =>
{
options.AddDefaultPolicy(policy =>
{
policy.AllowAnyOrigin(); // Dangerous!
});
});
// Good: Specific origins
builder.Services.AddCors(options =>
{
options.AddDefaultPolicy(policy =>
{
policy.WithOrigins("https://yourdomain.com");
});
});
Check for rate limiting on APIs:
// Good: Rate limiting configured
builder.Services.AddRateLimiter(options =>
{
options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(context =>
RateLimitPartition.GetFixedWindowLimiter(
partitionKey: context.User?.Identity?.Name ?? "anonymous",
factory: _ => new FixedWindowRateLimiterOptions
{
PermitLimit = 100,
Window = TimeSpan.FromMinutes(1)
}));
});
Check if default /umbraco path is changed:
// Good: Custom backoffice path
{
"Umbraco": {
"CMS": {
"Global": {
"UmbracoPath": "~/cms-admin"
}
}
}
}
Check for secure member authentication:
// Good: Secure cookie settings
builder.Services.ConfigureApplicationCookie(options =>
{
options.Cookie.HttpOnly = true;
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
options.Cookie.SameSite = SameSiteMode.Strict;
});
Check for parameterized queries:
// Bad: String concatenation
var query = $"SELECT * FROM Users WHERE Id = {userId}"; // SQL injection!
// Good: Parameterized
var query = scope.Database.Fetch<User>("SELECT * FROM Users WHERE Id = @0", userId);
| Code | Severity | Issue | Detection |
|---|---|---|---|
| SEC-001 | Critical | Content Delivery API public | PublicAccess: true without auth |
| SEC-002 | Critical | Hardcoded credentials | Password/key patterns in code |
| SEC-003 | Warning | Backoffice publicly accessible | No IP restrictions |
| SEC-004 | Warning | Missing rate limiting | No rate limiter configured |
| SEC-005 | Warning | Permissive CORS | AllowAnyOrigin() |
| SEC-006 | Info | Default admin path | Using /umbraco |
| SEC-007 | Info | Insecure cookie settings | Missing HttpOnly or Secure |
Read: appsettings.json
Check DeliveryApi configuration
Verify PublicAccess and ApiKey
Grep: password\s*[:=]\s*["'][^"']+["']
Grep: (api[_-]?key|secret)\s*[:=]
Glob: **/*.cs, **/*.json, **/*.config
Grep: AllowAnyOrigin
Grep: AddCors
Grep: WithOrigins
Grep: AddRateLimiter
Grep: RateLimitPartition
Read: appsettings.json
Check UmbracoPath setting
## Security Analysis
### Security Score: B
### Critical Issues
#### [SEC-001] Content Delivery API Publicly Accessible
**Location**: `appsettings.json:42`
**Configuration**:
```json
{
"DeliveryApi": {
"Enabled": true,
"PublicAccess": true
}
}
Impact: Anyone can query your content API Fix: Either disable public access or require API key:
{
"DeliveryApi": {
"Enabled": true,
"PublicAccess": false,
"ApiKey": "generate-secure-key-here"
}
}
Issue: No IP restrictions on backoffice Impact: Brute force attacks possible from anywhere Fix: Add IP whitelist in appsettings.json
Issue: No rate limiting on API endpoints Impact: Vulnerable to DoS attacks Fix: Add rate limiting middleware
| Setting | Status | Recommendation |
|---|---|---|
| DeliveryApi.PublicAccess | true | Change to false |
| BackofficeHost | Not set | Add restriction |
| RateLimiting | Not configured | Add middleware |
| UmbracoPath | /umbraco | Consider changing |