Silverstripe Framework - Cross-site Scripting Vulnerability in VersionedRequestFilter
Summary
GHSA-mpqj-f4v3-334h: Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter. Affects silverstripe/framework across 2 version ranges.
>= 3.3.2, < 3.3.3
>= 3.4.0, < 3.4.1
Fixed in 3.3.3 or 3.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe Framework is a popular PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including content management, database management, and user authentication. The VersionedRequestFilter is a component of the framework that handles user requests and manages the versioning of content. This vulnerability specifically affects the VersionedRequestFilter component.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability has been discovered in the VersionedRequestFilter component of the Silverstripe Framework. When an incoming user request is not authorized to access a specific stage, an error message is generated and displayed on the CMS login page. However, the URL of the requested page is not properly escaped before being interpolated into the error message. This allows an attacker to inject arbitrary HTML code into the CMS login page, potentially leading to session hijacking, phishing attacks, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.3.2, < 3.3.33.3.3composer require silverstripe/framework:3.3.3 -
>= 3.4.0, < 3.4.13.4.1composer require silverstripe/framework:3.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually escape the URL of the requested page before interpolating it into the error message. This can be done using appropriate HTML encoding functions or libraries. However, it is strongly recommended to apply the official fix by updating to the latest secure version of the Silverstripe Framework.
Conclusion
The Silverstripe Framework is vulnerable to a cross-site scripting (XSS) vulnerability in the VersionedRequestFilter component. This vulnerability can allow attackers to inject arbitrary HTML code into the CMS login page, potentially leading to various malicious activities. Developers should update their framework installations to the latest secure versions (3.3.3 or 3.4.1) to mitigate this vulnerability. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, or defacement of websites.
An attacker can exploit this vulnerability by crafting a specially crafted URL and tricking a user with access to the CMS login page to click on it. When the user visits the malicious URL, the injected HTML code will be executed in their browser, potentially allowing the attacker to steal sensitive information or perform unauthorized actions.
No, only versions 3.3.2 and 3.4.0 of the Silverstripe Framework are affected by this vulnerability. The Silverstripe team has released fixed versions (3.3.3 and 3.4.1) that address the issue.
There is currently no evidence of this vulnerability being actively exploited in the wild. However, it is important to apply the necessary security updates to prevent potential attacks.
You can find more information about this vulnerability, including technical details and the fixed versions of the Silverstripe Framework, in the official advisory provided by the Silverstripe team. The advisory can be accessed at the following URL: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-mpqj-f4v3-334h/GHSA-mpqj-f4v3-334h.json
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
