Skip to content
Log inStart free trial

GHSA-x5w2-wcr8-9q45

Silverstripe Missing security check on dev/build/defaults

Medium Packagist
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
CWE-425 Direct Request ('Forced Browsing')
Fix
3.1.17
Upgrade silverstripe/framework to this version or later

Description

The buildDefaults method on DevelopmentAdmin is missing a permission check.

In live mode, if you access /dev/build, you are requested to login first. However, if you access /dev/build/defaults, then the action is performed without any login check. This should be protected in the same way that /dev/build is. The buildDefaults view is requireDefaultRecords() on each DataObject class, and hence has the potential to modify database state. It also lists all modified tables, allowing attackers more insight into which modules are used, and how the database tables are structured.

Affected versions

Packagist

PackageVulnerableFixed in
silverstripe/framework
< 3.1.17
3.1.17
silverstripe/framework
>= 3.2.0, < 3.2.2
3.2.2
silverstripe/framework
>= 3.3.0-beta1, < 3.3.0
3.3.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

silverstripe/framework Packagist → 3.1.17

composer
composer require silverstripe/framework:^3.1.17

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Weakness

CWE-425: Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

How to prevent it
  • Architecture and Design, Operation: Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
  • Architecture and Design: Consider using MVC based frameworks such as Struts.

References

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
AdvisorySeverityWhy it's related
GHSA-gvrw-qqp5-jgc5
Silverstripe Framework: Possible XSS attack through media embed
Medium Also affects silverstripe/framework
GHSA-256q-hx8w-xcqx
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Medium Also affects silverstripe/framework
GHSA-rhx4-hvx9-j387
Silverstripe Framework has a XSS vulnerability in HTML editor
Medium Also affects silverstripe/framework
GHSA-74j9-xhqr-6qv3
Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-mqf3-qpc3-g26q
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-ff6q-3c9c-6cf5
Silverstripe Framework has a XSS in form messages
Medium Also affects silverstripe/framework
GHSA-7cmp-cgg8-4c82
Silverstripe Framework has a XSS via insert media remote file oembed
Medium Also affects silverstripe/framework
GHSA-52cw-pvq9-9m5v
Silverstripe uses TinyMCE which allows svg files linked in object tags
Medium Also affects silverstripe/framework
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor