CVE-2019-12246: SilverStripe Denial of Service on flush and development URL tools
Summary
CVE-2019-12246: SilverStripe Denial of Service on flush and development URL tools. Affects silverstripe/framework across 2 version ranges.
< 3.6
>= 4.0.0, < 4.4.0
Fixed in 3.6 or 4.4.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SilverStripe is a PHP framework used for building websites and web applications. It provides a flexible and powerful platform for developers to create and manage content-driven websites. The framework includes various tools and features, including flush and development URL tools, which allow developers to clear caches and test their applications during development. However, prior to version 4.4.0, SilverStripe is vulnerable to a Denial of Service (DoS) attack on these tools.
Vulnerability Detail
The vulnerability in SilverStripe allows an attacker to launch a DoS attack by exploiting the flush and development URL tools. By sending specially crafted requests to these tools, an attacker can overwhelm the server and cause it to become unresponsive or crash. This can lead to a disruption of service for legitimate users and potentially result in financial losses or reputational damage for affected organizations. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.63.6composer require silverstripe/framework:3.6 -
>= 4.0.0, < 4.4.04.4.0composer require silverstripe/framework:4.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched version of SilverStripe to mitigate the risk of a DoS attack.
Conclusion
In conclusion, the SilverStripe framework prior to version 4.4.0 is vulnerable to a Denial of Service (DoS) attack on the flush and development URL tools. This vulnerability can be mitigated by upgrading to the latest version of SilverStripe. It is recommended that developers promptly update their installations to ensure the security and stability of their applications. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
SilverStripe is a PHP framework used for building websites and web applications. It provides a flexible and powerful platform for developers to create and manage content-driven websites.
A Denial of Service (DoS) attack is a malicious attempt to disrupt the normal functioning of a network, service, or website by overwhelming it with a flood of illegitimate requests or traffic. This can result in the target becoming unresponsive or crashing, rendering it inaccessible to legitimate users.
Flush and development URL tools are features in SilverStripe that allow developers to clear caches and test their applications during development. These tools are used to ensure that changes and updates to the application are reflected correctly and to identify any issues or errors.
A DoS attack on SilverStripe can lead to a disruption of service for legitimate users. The server may become unresponsive or crash, rendering the website or application inaccessible. This can result in financial losses, reputational damage, and a negative user experience.
To protect your SilverStripe application from this vulnerability, it is crucial to upgrade to version 4.4.0 or later. This version includes a patch that fixes the vulnerability and prevents the DoS attack. Regularly updating your SilverStripe installation and staying informed about security vulnerabilities is essential for maintaining the security of your application.
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
