CVE-2024-29885: Silverstripe Reports Access Control Bypass
Summary
CVE-2024-29885: Silverstripe Reports are still accessible even when canView() returns false. Affects silverstripe/reports versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe Reports is a package available on Packagist that provides functionality for generating and viewing reports within the Silverstripe CMS. It allows users to create and manage various types of reports. The package is widely used in Silverstripe-based applications to generate and display data-driven reports. However, a vulnerability has been discovered in the package that allows unauthorized users to access reports even if they do not have the necessary permissions.
Vulnerability Detail
The vulnerability (CVE-2024-29885) in Silverstripe Reports allows any user with access to the reports admin section to directly access reports via their URL, even if the canView() method for that report returns false. This means that even if a user does not have the permission to view a specific report, they can still access it by knowing the direct URL. This bypasses the access control mechanism implemented by the package and exposes potentially sensitive information to unauthorized users.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require silverstripe/reports:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the Silverstripe Reports package to address the issue.
Conclusion
The vulnerability in the Silverstripe Reports package allows unauthorized users to bypass access control and access reports that they should not have permission to view. To address this issue, it is crucial to upgrade to version 5.2.3 or later of the package, which includes a fix for the access control bypass. By upgrading, the vulnerability will be mitigated, and unauthorized access to reports will no longer be possible.
See every vulnerability recorded for silverstripe/reports →
FAQ
The vulnerability allows unauthorized users to access reports that they should not have permission to view. This can lead to the exposure of sensitive information contained in those reports.
Any application that uses a version of the Silverstripe Reports package prior to 5.2.3 is affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, upgrading to version 5.2.3 or later of the Silverstripe Reports package will fix this vulnerability.
No, upgrading to the fixed version of the package is the only way to mitigate this vulnerability.
