Silverstripe XSS in Director::force_redirect()
Summary
GHSA-jqp8-v74p-g8px: Silverstripe XSS in Director::force_redirect(). Affects silverstripe/framework versions >= 3.1.0, < 3.1.12. Fixed in 3.1.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Silverstripe framework is an open-source PHP web application framework used for building websites and web applications. It provides a range of features and functionalities to simplify the development process. The Director::force_redirect method is a part of the framework that handles HTTP redirection. However, a low-level XSS vulnerability has been discovered in this method, which can potentially allow an attacker to inject malicious HTML code. This vulnerability affects versions 3.1.0 to 3.1.12 of the silverstripe/framework package.
Vulnerability Detail
The vulnerability arises from the fact that the Director::force_redirect method does not properly escape HTML when generating the HTTP redirection response. This means that if an attacker can manipulate the URL being redirected to, they can inject malicious HTML code that will be executed when the user's browser processes the response. However, it's important to note that this vulnerability is marked as low severity because it is difficult to exploit. The injected HTML will only be returned from the server if the Location HTTP header is also sent, which typically happens during a redirect. Therefore, regular users browsing the site would not be exposed to the injected HTML before their browser redirects them.
How To Fix
Minimum fixed version
3.1.12
This is the first release that contains the fix.
composer require silverstripe/framework:3.1.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by implementing proper input validation and sanitization techniques when handling user-generated input used in the redirection process.
Conclusion
In conclusion, the Silverstripe framework's Director::force_redirect method is vulnerable to a low-level XSS vulnerability. While the impact of this vulnerability is relatively low, it is still important to address it by upgrading to a fixed version and implementing proper input validation and sanitization techniques. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
The impact of this vulnerability is relatively low. Exploiting it requires the attacker to manipulate the URL being redirected to and for the Location HTTP header to be sent during the redirect. Regular users browsing the site would not be exposed to the injected HTML before their browser redirects them.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any open-source vulnerabilities, including this one, are found.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
There are no known exploits for this vulnerability at the moment. However, it is still important to address it by upgrading to a fixed version and implementing proper input validation and sanitization techniques.
You can find more information about this vulnerability, including its technical details and the fixed version, in the advisory published on the GitHub Advisory Database. The link to the advisory is available in the vulnerability details section.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
