Exposing Umbraco version?

Questions
1

Would it be possible to expose the Umbraco version through an endpoint ?

2

Yes, it is possible to get the Umbraco version. You can inject the IUmbracoVersion interface and get the semantic version out of that. It is documented here: Interface IUmbracoVersion | Umbraco c# Api docs

After that, you can create an endpoint that exposes it, but be careful around security – you probably don’t want to tell the world what exact version you are running due to security risks.

2 Likes
3

Yes exactly @jacob.

Version number is a key piece of information for an attacker as it can then allow them to research security vulnerabilities in that specific version with a higher chance of success in exploitation.

But of course, if you are keeping up to date with security patches, you have less to worry about!

2 Likes
4

We have an internal package that uses the ITelemetryService to fetch all the telemetry that Umbraco itself collects (including version number, packages etc), and then posts it to and endpoint on a webservice where we collect the data. We then have an overview of all our projects, including information about what they have installed.

The telemetry data is reported daily using an IRecurringBackgroundJob

3 Likes
5

That sounds like a good way to do it :slight_smile:
I will look into that, thanks.

As for now I do like this.
Even with the security issues it might have :slight_smile:

using Umbraco.Cms.Web.Common.Controllers;
using Microsoft.AspNetCore.Mvc;
using System.Diagnostics;
using Umbraco.Cms.Core.Services;

namespace Modgift.Controllers;

[Route("stuff/[action]")]
[ApiController]
public class MaintenanceController : UmbracoApiController
{
    [HttpGet]
    public IActionResult Version()
    {
        string dllPath = typeof(IContentService).Assembly.Location;
        FileVersionInfo versionInfo = FileVersionInfo.GetVersionInfo(dllPath);

        string[] versionParts = (versionInfo?.ProductVersion ?? string.Empty).Split('+', 2);
        string version = versionParts.ElementAtOrDefault(0) ?? string.Empty;
        string assembly = versionParts.ElementAtOrDefault(1) ?? string.Empty;

        var result = new UmbracoVersion
        {
            ProductName = versionInfo?.ProductName,
            Version = version,
            Assembly = assembly,
        };

        return Ok(result);
    }
}

public class UmbracoVersion
{
    public string? ProductName { get; set; }
    public string? Version { get; set; }
    public string? Assembly { get; set; }
}
6

Hi Søren,

When I try to use the ITelemetryService to get a TelemetryReportData all I get is this

{
  "id": "7cab782f-181e-45b7-a8c1-31bea9c0643c",
  "version": null,
  "packages": null,
  "detailed": null
}

Do you have any idea why it’s only the id property that has a value ?

I’m injecting the ITelemetryService and using TryGetTelemetryReportData to get the report.

7

Doh … now I know why :man_facepalming:

When I initially spun up my umbraco I chose minimal telemetry :slight_smile:

2 Likes
8

This topic was automatically closed 5 days after the last reply. New replies are no longer allowed.