Vulnerability in silverstripe/framework: ReadOnly transformation for formfields exploitable
Summary
GHSA-97jm-g33h-f46g: silverstripe/framework ReadOnly transformation for formfields exploitable. Affects silverstripe/framework across 4 version ranges.
< 3.1.21
>= 3.2.0, < 3.2.6
>= 3.3.0, < 3.3.4
>= 3.4.0, < 3.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The silverstripe/framework package is a PHP framework used for building web applications. It provides a range of features and functionalities to simplify the development process. However, a vulnerability has been discovered in the framework related to the ReadOnly transformation for form fields.
Vulnerability Detail
Form fields in the silverstripe/framework package that return isReadonly() as true are vulnerable to reflected XSS injections. This includes fields like ReadonlyField, LookupField, HTMLReadonlyField, and TimeField_Readonly. When values submitted through these form fields are not filtered out from the form session data, they may be displayed to the user depending on the form behavior. This can lead to potential cross-site scripting (XSS) attacks. It's important to note that Readonly and disabled form fields are already filtered out in Form->saveInto(), preventing maliciously submitted data from being stored in the database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.213.1.21composer require silverstripe/framework:3.1.21 -
>= 3.2.0, < 3.2.63.2.6composer require silverstripe/framework:3.2.6 -
>= 3.3.0, < 3.3.43.3.4composer require silverstripe/framework:3.3.4 -
>= 3.4.0, < 3.4.23.4.2composer require silverstripe/framework:3.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to manually filter out the form session data for the vulnerable form fields before displaying them to the user. This can be done by implementing custom logic in the form construction process to overwrite the data from request data (GET and POST) for these fields.
Conclusion
The silverstripe/framework package is vulnerable to a reflected XSS vulnerability in form fields returning isReadonly() as true. This can lead to potential cross-site scripting attacks and unauthorized access. It is crucial to update the package to the fixed versions or implement the recommended workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability allows for potential cross-site scripting (XSS) attacks, where an attacker can inject malicious code into the form fields and have it executed in the context of the user's browser. This can lead to unauthorized access, data theft, or other malicious activities.
Form fields returning isReadonly() as true are affected by this vulnerability. This includes ReadonlyField, LookupField, HTMLReadonlyField, and TimeField_Readonly.
No, Readonly and disabled form fields are already filtered out in Form->saveInto(), preventing maliciously submitted data from being stored in the database.
The recommended mitigation is to update the silverstripe/framework package to the fixed versions mentioned earlier. Additionally, implementing custom logic to filter out the form session data for the vulnerable form fields can serve as a temporary workaround.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to apply the recommended fixes as soon as possible to prevent potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
