Silverstripe Missing security check on dev/build/defaults
Summary
GHSA-x5w2-wcr8-9q45: Silverstripe Missing security check on dev/build/defaults. Affects silverstripe/framework across 3 version ranges.
< 3.1.17
>= 3.2.0, < 3.2.2
>= 3.3.0-beta1, < 3.3.0
Fixed in 3.1.17, 3.2.2 or 3.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe is an open-source PHP framework used for building websites and web applications. It provides a flexible and extensible platform for developers to create and manage content-driven websites. The framework includes various modules and features that facilitate the development process. However, a vulnerability has been discovered in the framework related to the missing security check on the 'dev/build/defaults' endpoint.
Vulnerability Detail
The 'dev/build/defaults' endpoint in Silverstripe allows users to perform actions related to default record building without proper authentication. While the 'dev/build' endpoint requires users to log in before accessing it, the 'dev/build/defaults' endpoint does not enforce this security measure. This vulnerability can be exploited by attackers to modify the database state and gain insights into the structure of the database tables. The potential ramifications include unauthorized modifications to the database and exposure of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.173.1.17composer require silverstripe/framework:3.1.17 -
>= 3.2.0, < 3.2.23.2.2composer require silverstripe/framework:3.2.2 -
>= 3.3.0-beta1, < 3.3.03.3.0composer require silverstripe/framework:3.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually add authentication checks to the 'dev/build/defaults' endpoint. This can be done by modifying the code responsible for handling the endpoint and implementing a login check before allowing any actions to be performed. Here is an example of how the code can be modified:
// Add the following code to the 'buildDefaults' method in DevelopmentAdmin.php
public function buildDefaults()
{
if (!Member::currentUser()) {
Security::permissionFailure();
}
// Existing code for performing actions
}
Conclusion
The vulnerability in Silverstripe's 'dev/build/defaults' endpoint can lead to unauthorized modifications to the database and exposure of sensitive information. It is crucial to apply the available patches or update to the fixed versions (3.1.17, 3.2.2, or 3.3.0) to mitigate the risk. Additionally, implementing the provided workaround can provide temporary protection until the update is applied. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
This vulnerability allows unauthorized users to perform actions related to default record building without proper authentication. It can lead to unauthorized modifications to the database and exposure of sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, not all versions of Silverstripe are affected. The vulnerability exists in versions up to 3.1.16, 3.2.1, and 3.3.0-beta1. Versions 3.1.17, 3.2.2, and 3.3.0 have fixed the issue.
If your Silverstripe application is affected, it is recommended to update to the fixed versions (3.1.17, 3.2.2, or 3.3.0) as soon as possible. Additionally, you can implement the provided workaround to add authentication checks to the 'dev/build/defaults' endpoint.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to prevent any potential unauthorized access or modifications.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
