User session hijacking vulnerability in silverstripe/framework
Summary
GHSA-4qx8-j9vh-2628: silverstripe/framework's User-Agent header not correctly invalidating user session. Affects silverstripe/framework across 2 version ranges.
>= 3.5.0-rc1, < 3.5.6
>= 3.6.0-rc1, < 3.6.3
Fixed in 3.5.6 or 3.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is an open-source PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including session management. However, a vulnerability has been identified in the framework's handling of the User-Agent header, which can lead to session hijacking.
Vulnerability Detail
The vulnerability in silverstripe/framework allows an attacker to bypass the session protection mechanism by modifying the User-Agent header. The framework is designed to detect changes in the User-Agent header and invalidate the user session if any modifications are detected. However, due to a flaw in the implementation, this protection mechanism does not work as intended. As a result, an attacker can modify the User-Agent header and maintain an active session, potentially leading to unauthorized access and data exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5.0-rc1, < 3.5.63.5.6composer require silverstripe/framework:3.5.6 -
>= 3.6.0-rc1, < 3.6.33.6.3composer require silverstripe/framework:3.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of silverstripe/framework as soon as possible.
Conclusion
The user session hijacking vulnerability in silverstripe/framework can have serious security implications, allowing attackers to maintain active sessions even after modifying the User-Agent header. It is crucial for developers to update to the fixed versions of the framework (3.5.6 or 3.6.3) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
silverstripe/framework is a PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers.
Session hijacking is a security attack where an attacker gains unauthorized access to a user's session by stealing or manipulating session identifiers.
The User-Agent header is a part of the HTTP request that contains information about the client making the request. By detecting changes in the User-Agent header, the framework can identify potential session hijacking attempts and invalidate the user session.
This vulnerability can lead to unauthorized access to user accounts and sensitive data. Attackers can maintain active sessions even after modifying the User-Agent header, potentially compromising the security and privacy of users.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
