Silverstripe XSS In rewritten hash links
Summary
GHSA-34q6-xqxh-gq39: Silverstripe XSS In rewritten hash links. Affects silverstripe/framework across 2 version ranges.
< 3.0.13
>= 3.1.0, < 3.1.12
Fixed in 3.0.13 or 3.1.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SilverStripe is an open-source framework used for building websites and web applications. It provides a flexible and powerful platform for developers to create and manage content. The framework includes various features such as a templating engine (SSViewer) for rendering web pages, a data model for managing content (DataObject), and a security layer for protecting against common vulnerabilities. However, a high-level XSS vulnerability has been discovered in the SilverStripe framework, specifically in the way it handles rewritten hash links.
Vulnerability Detail
The vulnerability in SilverStripe's rewritten hash links arises from the unsafe rewriting of links containing hash anchors (e.g., href="#anchor"). The framework's SSViewer's rewriteHashlinks option is responsible for rewriting these links to include the current URL. However, due to inadequate escaping, this opens up the possibility of HTML injection via the query string. Attackers can exploit this vulnerability by injecting malicious code into the query string, which will then be rendered as part of the web page. This can lead to various consequences, including unauthorized access, data theft, and the execution of arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.133.0.13composer require silverstripe/framework:3.0.13 -
>= 3.1.0, < 3.1.123.1.12composer require silverstripe/framework:3.1.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to disable the rewriteHashlinks option in SSViewer. This can be done by modifying the configuration file or code where the option is set. By disabling this option, the vulnerable behavior is bypassed, but it may impact the functionality of hash links in the application. It is strongly recommended to apply the permanent fix by upgrading to a fixed version as soon as possible.
Conclusion
The XSS vulnerability in SilverStripe's rewritten hash links can have serious security implications for affected applications. It is crucial to apply the recommended fix by upgrading to a fixed version of the SilverStripe framework. If immediate upgrade is not possible, disabling the rewriteHashlinks option can serve as a temporary workaround. However, it is strongly advised to implement the permanent fix as soon as possible. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various consequences, including unauthorized access, data theft, and the execution of arbitrary code.
The vulnerability in SilverStripe's rewritten hash links allows attackers to inject HTML code into web pages by exploiting the inadequate escaping of query string values. By injecting malicious code into the query string, the attacker can manipulate the rendered content and potentially execute arbitrary scripts.
The impact of this vulnerability can vary depending on the specific application and its usage. However, potential consequences include unauthorized access to sensitive information, data manipulation or theft, and the execution of arbitrary code on the affected system.
No, not all versions of SilverStripe are affected. The vulnerability exists in versions 3.0.0 to 3.0.12 and 3.1.0 to 3.1.11. It has been fixed in versions 3.0.13 and 3.1.12, respectively. It is important to upgrade to the fixed versions to ensure the vulnerability is mitigated.
You can use Vulert's playground (https://vulert.com/scanner) to check if your SilverStripe application is affected by this vulnerability. Vulert analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities, including this XSS vulnerability in SilverStripe.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
