CVE-2024-47605: Silverstripe Framework XSS Vulnerability via oEmbed Media Insertion
Summary
CVE-2024-47605: Silverstripe Framework has a XSS via insert media remote file oembed. Affects silverstripe/framework versions < 5.3.8. Fixed in 5.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe Framework is an open-source content management system (CMS) and framework for building web applications. It provides a flexible and user-friendly interface for managing website content, allowing developers to create custom functionalities. However, the framework has a vulnerability that can be exploited through its 'insert media' feature, which allows users to embed content from external sources using oEmbed.
Vulnerability Detail
The vulnerability arises from the 'insert media' functionality within the Silverstripe Framework, where the linked oEmbed JSON includes an HTML attribute that replaces the embed shortcode. This HTML is not properly sanitized before being inserted, allowing an attacker to execute a script payload on both the CMS and the front-end of the website. This could lead to unauthorized actions being performed on behalf of users, data theft, or defacement of the website.
How To Fix
Minimum fixed version
5.3.8
This is the first release that contains the fix.
composer require silverstripe/framework:5.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'insert media' functionality until the framework is updated. This can be done by removing or commenting out the relevant code in your application that allows for media insertion.
Conclusion
The Silverstripe Framework has a moderate severity XSS vulnerability (CVE-2024-47605) that can be exploited through its media insertion feature. It is crucial to update to the patched version to protect your application from potential attacks. Utilize Vulert to monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for silverstripe/framework →
FAQ
CVE-2024-47605 is a vulnerability in the Silverstripe Framework that allows for cross-site scripting (XSS) attacks through the 'insert media' feature.
If exploited, this vulnerability can allow attackers to execute malicious scripts on your website, potentially leading to data theft or unauthorized actions.
Yes, a patch is available in Silverstripe Framework version 5.3.8 and later. It is recommended to update to this version to mitigate the risk.
If you cannot update immediately, consider disabling the 'insert media' functionality as a temporary workaround to prevent exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
