Vulnerability in silverstripe/framework: ChangePasswordForm does not check Member::canLogIn()

Background

silverstripe/framework is a PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including user authentication and password management. However, a vulnerability has been identified in the ChangePasswordForm component of the framework, which allows users to log in without proper authorization checks.

Vulnerability Detail

After performing a password reset, the ChangePasswordForm component in silverstripe/framework logs in the user without checking Member::canLogIn(). This poses a security risk for websites that rely on this method to deny access to certain users, such as those who have not been approved or have temporarily lost access privileges. While Member::canLogIn() was originally designed to check for lockouts due to incorrect login attempts, it has been expanded to other uses, potentially compromising the security of the application.

Workaround

If updating the framework is not immediately feasible, a temporary workaround can be implemented by modifying the ChangePasswordForm::doChangePassword() method to include a check for Member::canLogIn() before logging in the user. Here is an example of the modified code:

public function doChangePassword(array $data, Form $form)
{
    // Existing code
    ...

    // Additional check
    if (!$this->member->canLogIn()) {
        // Handle the case where the user is not allowed to log in
        ...
        return;
    }

    // Log in the user
    ...
}

Conclusion

In conclusion, the silverstripe/framework package is vulnerable to a security issue in the ChangePasswordForm component. This vulnerability allows users to log in without proper authorization checks, potentially compromising the security of the application. It is recommended to update the framework to the latest stable release or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for silverstripe/framework →

FAQ