User ID Enumeration Vulnerability in silverstripe/framework
Summary
GHSA-g84q-cq55-xwgp: silverstripe/framework member disclosure in login form. Affects silverstripe/framework across 2 version ranges.
>= 3.4.0-rc1, < 3.4.6
>= 3.5.0-rc1, < 3.5.4
Fixed in 3.4.6 or 3.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is a PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including user authentication and login functionality. However, a vulnerability has been discovered in the login form of the framework, which allows for user ID enumeration.
Vulnerability Detail
The vulnerability in silverstripe/framework's login form allows an attacker to infer or confirm the existence of user details in the member table. By exploiting this vulnerability, an attacker can determine whether a user exists in the system or not. This can be done by analyzing the brute force error messages returned by the login form. Non-existent users will never receive a locked out message, while existing users will receive a locked out message. This information disclosure can aid attackers in their attempts to gain unauthorized access to user accounts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.4.0-rc1, < 3.4.63.4.6composer require silverstripe/framework:3.4.6 -
>= 3.5.0-rc1, < 3.5.43.5.4composer require silverstripe/framework:3.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to update the silverstripe/framework package to the fixed versions mentioned above.
Conclusion
The user ID enumeration vulnerability in silverstripe/framework's login form can lead to unauthorized access to user accounts. It is crucial to update the silverstripe/framework package to the fixed versions (3.4.6 or 3.5.4) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability allows attackers to determine the existence of user details in the member table, which can aid in unauthorized access to user accounts.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and the playground will analyze it for vulnerabilities.
There are no known exploits for this vulnerability at the moment. However, it is important to update to the fixed versions to prevent any potential attacks.
No, the recommended mitigation is to update the silverstripe/framework package to the fixed versions.
You can find more information about this vulnerability in the GitHub Advisory Database at the following source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-g84q-cq55-xwgp/GHSA-g84q-cq55-xwgp.json
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
