Silverstripe Form field validation message XSS vulnerability in silverstripe/framework
Summary
GHSA-j982-5jv7-v43r: Silverstripe Form field validation message XSS vulnerability. Affects silverstripe/framework across 2 version ranges.
>= 3.0.0, < 3.1.16
>= 3.2.0, < 3.2.1
Fixed in 3.1.16 or 3.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe framework is a popular PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including form field validation. However, a vulnerability has been discovered in certain FormField classes that handle the encoding of validation messages. This vulnerability affects versions 3.0.0 to 3.1.16 and 3.2.0 to 3.2.1 of the silverstripe/framework package.
Vulnerability Detail
The vulnerability involves a high-level XSS risk due to improper encoding of validation messages in certain FormField classes. Fields such as NumericField and DropdownField are specifically identified as being at risk, but any form field that presents invalid content as part of its validation response can be affected. This vulnerability can potentially allow an attacker to inject malicious code into the validation message, leading to cross-site scripting attacks and potential data compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.1.163.1.16composer require silverstripe/framework:3.1.16 -
>= 3.2.0, < 3.2.13.2.1composer require silverstripe/framework:3.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize and encode the validation messages before displaying them to users. This can be done by using appropriate encoding functions or libraries, such as htmlspecialchars() in PHP, to prevent the execution of any injected malicious code. Here's an example of how to sanitize a validation message in PHP:
$message = htmlspecialchars($message);
Conclusion
In conclusion, the Silverstripe framework is vulnerable to an XSS vulnerability in certain FormField classes. It is crucial for developers to update to the fixed versions of the silverstripe/framework package and properly sanitize and encode validation messages to mitigate the risk of XSS attacks. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
This vulnerability can allow an attacker to inject malicious code into validation messages, leading to potential cross-site scripting attacks. It can compromise the security of user data and expose users to various risks.
Versions 3.0.0 to 3.1.16 and 3.2.0 to 3.2.1 of the silverstripe/framework package are affected by this vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the issue promptly to prevent any potential exploitation.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
You can find more information about this vulnerability, including the technical details and affected package versions, in the advisory published on the GitHub Advisory Database. The link to the advisory is provided in the 'database_specific' field of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
