Unescaped Member Name in silverstripe/framework
Summary
GHSA-r9vp-fp72-xgf7: silverstripe/framework's Member.Name is not escaped. Affects silverstripe/framework across 4 version ranges.
>= 3.1.9-rc1, < 3.1.20
>= 3.2.4-rc1, < 3.2.5
>= 3.3.2-rc1, < 3.3.3
>= 3.4.0-rc1, < 3.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is an open-source PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including templating and content management. However, a vulnerability has been identified in the framework's handling of the Member.Name property, which can lead to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the core template file 'framework/templates/Includes/GridField_print.ss', which includes the line 'Printed by $Member.Name'. This line is responsible for displaying the name of the currently logged-in member. However, if the member's first name or surname contains malicious HTML or JavaScript code, it will be rendered as raw HTML on the page, potentially allowing an attacker to execute arbitrary code in the context of the user's session.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1.9-rc1, < 3.1.203.1.20composer require silverstripe/framework:3.1.20 -
>= 3.2.4-rc1, < 3.2.53.2.5composer require silverstripe/framework:3.2.5 -
>= 3.3.2-rc1, < 3.3.33.3.3composer require silverstripe/framework:3.3.3 -
>= 3.4.0-rc1, < 3.4.13.4.1composer require silverstripe/framework:3.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the Member.Name property before passing it to the template. This can be done by using PHP's htmlspecialchars() function or similar methods to escape special characters and prevent them from being interpreted as HTML or JavaScript code. Here is an example of how the workaround can be implemented:
$escapedName = htmlspecialchars($member->getName(), ENT_QUOTES, 'UTF-8');
$template->setVariable('MemberName', $escapedName);
Please note that this is a temporary solution and should be replaced with a proper fix as soon as possible.
Conclusion
The unescaped Member.Name vulnerability in silverstripe/framework can potentially lead to cross-site scripting (XSS) attacks. It is crucial for developers to properly escape and sanitize user input to prevent the injection of malicious code. The recommended fix is to update to the latest version of the framework and ensure proper escaping of the Member.Name property. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability allows an attacker to inject and execute arbitrary code in the context of the user's session. This can lead to various malicious activities, including stealing sensitive information, modifying user data, or performing actions on behalf of the user.
The vulnerability affects versions 3.1.9-rc1 to 3.1.20, 3.2.4-rc1 to 3.2.5, 3.3.2-rc1 to 3.3.3, and 3.4.0-rc1 to 3.4.1 of the silverstripe/framework package.
Yes, the vulnerability has been fixed in versions 3.1.20, 3.2.5, 3.3.3, and 3.4.1 of the silverstripe/framework package. It is recommended to update to the latest version to mitigate the risk.
At the time of writing, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the issue promptly to prevent potential exploitation.
You can find more information about this vulnerability, including the technical details and fixed versions, in the advisory published on the GitHub Advisory Database: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
