Skip to content
Log inStart free trial

GHSA-g4hp-pfvf-vm5w

SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

Medium Packagist
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
CWE-639 Authorization Bypass Through User-Controlled Key
Fix
3.0.14
Upgrade silverstripe/framework to this version or later

Description

When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.

For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service.

The fix in this case is to ensure that empty tokens fail the validation check.

Affected versions

Packagist

PackageVulnerableFixed in
silverstripe/framework
>= 3.0.0, < 3.0.14
3.0.14
silverstripe/framework
>= 3.1.0, < 3.1.13
3.1.13

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

silverstripe/framework Packagist → 3.0.14

composer
composer require silverstripe/framework:^3.0.14

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Weakness

CWE-639: Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

How to prevent it
  • Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
  • Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
  • Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

References

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
AdvisorySeverityWhy it's related
GHSA-gvrw-qqp5-jgc5
Silverstripe Framework: Possible XSS attack through media embed
Medium Also affects silverstripe/framework
GHSA-256q-hx8w-xcqx
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Medium Also affects silverstripe/framework
GHSA-rhx4-hvx9-j387
Silverstripe Framework has a XSS vulnerability in HTML editor
Medium Also affects silverstripe/framework
GHSA-74j9-xhqr-6qv3
Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-mqf3-qpc3-g26q
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-ff6q-3c9c-6cf5
Silverstripe Framework has a XSS in form messages
Medium Also affects silverstripe/framework
GHSA-7cmp-cgg8-4c82
Silverstripe Framework has a XSS via insert media remote file oembed
Medium Also affects silverstripe/framework
GHSA-52cw-pvq9-9m5v
Silverstripe uses TinyMCE which allows svg files linked in object tags
Medium Also affects silverstripe/framework
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor