SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
Summary
GHSA-g4hp-pfvf-vm5w: SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation. Affects silverstripe/framework across 2 version ranges.
>= 3.0.0, < 3.0.14
>= 3.1.0, < 3.1.13
Fixed in 3.0.14 or 3.1.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SilverStripe is an open-source content management system (CMS) and framework written in PHP. It provides a flexible and scalable platform for building websites and web applications. The SilverStripe framework, specifically versions 3.0.0 to 3.0.13 and 3.1.0 to 3.1.13, is affected by a vulnerability related to the validation of 'isDev', 'isTest', and 'flush' parameters in the $_GET request. These parameters are used to control the site's development mode and cache flushing functionality. However, an empty token parameter can be provided to bypass normal authentication parameters, leading to potential security risks.
Vulnerability Detail
The vulnerability allows an attacker to exploit the 'isDev', 'isTest', and 'flush' parameters by providing an empty token parameter in the $_GET request. By doing so, an attacker can force a SilverStripe site into development mode or cause excessive load by repeatedly triggering cache flushing. This can lead to unauthorized access to sensitive information, potential denial of service (DoS) attacks, and other security risks. The vulnerability affects versions 3.0.0 to 3.0.13 and 3.1.0 to 3.1.13 of the SilverStripe framework.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.0.143.0.14composer require silverstripe/framework:3.0.14 -
>= 3.1.0, < 3.1.133.1.13composer require silverstripe/framework:3.1.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update the SilverStripe framework to the latest secure version.
Conclusion
The SilverStripe framework versions 3.0.0 to 3.0.13 and 3.1.0 to 3.1.13 are vulnerable to a security issue related to the validation of 'isDev', 'isTest', and 'flush' parameters in the $_GET request. Attackers can exploit this vulnerability by providing an empty token parameter, allowing them to bypass authentication and potentially perform unauthorized actions or cause denial of service. It is crucial to update the SilverStripe framework to the latest secure version (3.0.14 or higher for 3.0.x and 3.1.14 or higher for 3.1.x) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
SilverStripe is an open-source content management system (CMS) and framework written in PHP. It provides a flexible and scalable platform for building websites and web applications.
The vulnerability allows attackers to bypass authentication parameters and force a SilverStripe site into development mode or cause excessive load by triggering cache flushing. This can lead to unauthorized access to sensitive information, potential denial of service (DoS) attacks, and other security risks.
Versions 3.0.0 to 3.0.13 and 3.1.0 to 3.1.13 of the SilverStripe framework are affected by this vulnerability.
To fix this vulnerability, it is recommended to update the SilverStripe framework to version 3.0.14 or higher for versions 3.0.x, and version 3.1.14 or higher for versions 3.1.x. These updated versions include the necessary validation checks to prevent empty token parameters from bypassing authentication.
There are no specific workarounds mentioned for this vulnerability. It is advised to follow the recommended fix and update the SilverStripe framework to the latest secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
