CVE-2019-12204: Missing warning can lead to unauthenticated admin access in SilverStripe
Summary
CVE-2019-12204: Missing warning can lead to unauthenticated admin access in SilverStripe. Affects silverstripe/cms versions >= 4.4.0, < 4.4.4. Fixed in 4.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SilverStripe is a popular open-source content management system (CMS) written in PHP. It provides a flexible and powerful platform for building websites and web applications. The SilverStripe framework is the core component of the CMS, providing the foundation for managing content, templates, and user authentication. The vulnerability identified as CVE-2019-12204 affects both the SilverStripe framework and the SilverStripe CMS.
Vulnerability Detail
The vulnerability in SilverStripe versions up to 4.3.3 is due to a missing warning about leaving the 'install.php' file in a public webroot. This oversight can lead to unauthenticated administrative access. Attackers can exploit this vulnerability by accessing the 'install.php' file and completing the installation process, gaining administrative privileges without proper authentication. This can result in unauthorized access to sensitive data, modification of website content, and potential compromise of the entire application.
How To Fix
Minimum fixed version
4.4.4
This is the first release that contains the fix.
composer require silverstripe/cms:4.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to manually restrict access to the 'install.php' file using server configuration or access control rules. This can be achieved by configuring the web server to deny access to the file based on IP address or by implementing authentication mechanisms specifically for the 'install.php' file. However, it is important to note that this workaround may introduce additional complexity and should be thoroughly tested to ensure it does not inadvertently impact legitimate access to the installation process.
Conclusion
The missing warning about leaving the 'install.php' file in a public webroot can lead to unauthenticated admin access in SilverStripe. It is crucial to promptly apply the recommended fix by removing the file after installation and keeping the SilverStripe framework and CMS up to date. Regularly monitoring for security advisories and promptly applying updates is essential to mitigate the risk of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/cms →
FAQ
This vulnerability can allow unauthenticated users to gain administrative access to a SilverStripe installation, potentially leading to unauthorized access to sensitive data and the ability to modify website content.
SilverStripe versions up to 4.3.3 are affected by this vulnerability. The issue has been fixed in versions 4.3.6 and 4.4.4.
You can use the Vulert Playground at Vulert Scanner to check if your SilverStripe installation is affected by this vulnerability. Simply provide the path to your 'composer.lock' file, and Vulert will analyze it for any known vulnerabilities.
Yes, a workaround is to manually restrict access to the 'install.php' file using server configuration or access control rules. However, it is recommended to follow the official fix and remove the file from the public webroot after installation.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/cms.
