Silverstripe XSS in dev/build returnURL Parameter
Summary
GHSA-hq4p-5mpr-jj9m: Silverstripe XSS in dev/build returnURL Parameter. Affects silverstripe/framework versions < 3.1.14. Fixed in 3.1.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe is an open-source PHP framework used for building websites and web applications. It provides a flexible and modular architecture for developers to create and manage content-driven websites. The framework includes various features such as a templating engine, database abstraction layer, and an administration interface. However, a vulnerability has been identified in the returnURL parameter passed to the dev/build endpoint. This parameter is not properly validated, which could allow an attacker to inject malicious code and execute cross-site scripting (XSS) attacks. This vulnerability affects the Silverstripe framework version 0 to 3.1.13.
Vulnerability Detail
The vulnerability arises due to the lack of input validation on the returnURL parameter in the dev/build endpoint. An attacker can craft a malicious URL and trick a user into visiting it. When the user accesses the dev/build endpoint with the manipulated returnURL parameter, the malicious code will be executed in the user's browser. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and the potential for further exploitation of the affected system.
How To Fix
Minimum fixed version
3.1.14
This is the first release that contains the fix.
composer require silverstripe/framework:3.1.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating the returnURL parameter before processing it in the dev/build endpoint. This can be done by checking if the URL belongs to the same domain or a trusted domain. If the URL is not trusted, it should be rejected or redirected to a safe location.
Conclusion
The Silverstripe framework is vulnerable to a cross-site scripting (XSS) attack due to the lack of input validation on the returnURL parameter in the dev/build endpoint. To mitigate this risk, it is recommended to upgrade to version 3.1.14 or implement a manual validation workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
This vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized access, data theft, and further exploitation of the affected system.
No, only versions 0 to 3.1.13 of the Silverstripe framework are vulnerable to this XSS issue. The vulnerability has been fixed in version 3.1.14.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is important to apply the recommended fix or workaround as soon as possible to prevent potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious URL and trick a user into visiting it, triggering the execution of the XSS payload.
Yes, the CVSS score for this vulnerability is 4.7, indicating a moderate severity level. It is important to address this vulnerability to prevent potential security breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
