Open Source Vulnerability in silverstripe/admin: No Permission Checks for Editing/Deleting Records with CSV Import Form
Summary
CVE-2023-49783: No permission checks for editing/deleting records with CSV import form. Affects silverstripe/admin across 2 version ranges.
>= 1.0.0, < 1.13.19
>= 2.0.0, < 2.1.8
Fixed in 1.13.19 or 2.1.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/admin is a package in the Packagist ecosystem that provides an administration interface for SilverStripe CMS. It allows users to manage and manipulate records in the CMS. However, a vulnerability has been discovered in the package that allows users without edit or delete permissions to still modify or delete records using the CSV import form. This vulnerability can potentially lead to unauthorized changes or deletions of sensitive data.
Vulnerability Detail
The vulnerability arises from a lack of permission checks in the CSV import form of the ModelAdmin component. Even if a user does not have edit or delete permissions for certain records, they can still make modifications or deletions using the import form if they have create permissions. While the likelihood of a user having create permissions but not edit or delete permissions is low, it is still possible. It's important to note that this vulnerability does not affect ModelAdmin instances with the import form disabled or the SecurityAdmin section.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.13.191.13.19composer require silverstripe/admin:1.13.19 -
>= 2.0.0, < 2.1.82.1.8composer require silverstripe/admin:2.1.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The Open Source Vulnerability in silverstripe/admin allows users without edit or delete permissions to modify or delete records using the CSV import form. It is recommended to update any custom implementations of BulkLoader and consider passing true to setCheckPermissions() if using BulkLoader in your own project logic. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/admin →
FAQ
The vulnerability allows users without edit or delete permissions to modify or delete records using the CSV import form. This can potentially lead to unauthorized changes or deletions of sensitive data.
While it is not common, it is still possible for a user to have create permissions but not edit or delete permissions. This vulnerability accounts for such scenarios.
No, this vulnerability only affects ModelAdmin instances that have the import form enabled. If the import form is disabled, the vulnerability does not apply.
No, the SecurityAdmin section is not affected by this vulnerability. The issue is specific to the CSV import form in ModelAdmin.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/admin.
