Silverstripe Framework - XSS In GridField print
Summary
GHSA-88jp-9jrv-6368: Silverstripe XSS In GridField print. Affects silverstripe/framework versions >= 3.1.0, < 3.1.10. Fixed in 3.1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe Framework is a PHP web application framework that provides a flexible and powerful foundation for building websites and applications. It includes various features and components to facilitate content management, including GridField, which allows users to manage and display tabular data. However, a cross-site scripting (XSS) vulnerability has been discovered in the print view of GridField.
Vulnerability Detail
The XSS vulnerability in GridField's print view can be exploited if a user with CMS access has posted malicious or unescaped HTML into any field of an object in a GridField, and the print feature is used. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially compromising their session or stealing sensitive information. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.1.10
This is the first release that contains the fix.
composer require silverstripe/framework:3.1.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the print feature in GridField or implement custom sanitization measures to escape HTML and prevent XSS attacks. Here is an example of how to disable the print feature in GridField:
// Disable print feature
$gridFieldConfig->removeComponentsByType('GridFieldPrintButton');
Conclusion
The XSS vulnerability in Silverstripe Framework's GridField print view can be mitigated by upgrading to version 3.1.10 or later. Alternatively, users can disable the print feature or implement custom sanitization measures. It is important to stay updated with the latest security patches and follow best practices to ensure the security of your Silverstripe Framework installation. For further support or assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially compromising their session or stealing sensitive information.
Users of Silverstripe Framework versions 3.1.0 to 3.1.9 are affected by this vulnerability if they have CMS access and use the print feature in GridField.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is recommended to apply the patch or workaround as soon as possible to mitigate the risk.
There are no other related vulnerabilities reported in Silverstripe Framework at the time of this advisory. However, it is always recommended to keep the framework and its dependencies up to date to prevent potential security issues.
You can find more information about this vulnerability, including the patch and its implementation details, in the official advisory provided by the Silverstripe Framework team.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
