User Enumeration Vulnerability in silverstripe/framework
Summary
GHSA-7m2v-x7rg-5hm5: User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials. Affects silverstripe/framework across 2 version ranges.
>= 3.5.0-rc1, < 3.5.5
>= 3.6.0-rc1, < 3.6.2
Fixed in 3.5.5 or 3.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is an open-source PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including a login and password reset system. However, a vulnerability has been discovered in the framework that allows for user enumeration through timing attacks on the login and password reset forms.
Vulnerability Detail
The vulnerability in silverstripe/framework allows an attacker to perform a timing attack on the login or password reset pages with user credentials. By carefully measuring the response times of these pages, an attacker can determine if a particular user exists in the system. This can lead to user enumeration, where an attacker can gather a list of valid usernames or email addresses. This information can then be used for further attacks, such as brute-forcing passwords or targeted phishing campaigns.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5.0-rc1, < 3.5.53.5.5composer require silverstripe/framework:3.5.5 -
>= 3.6.0-rc1, < 3.6.23.6.2composer require silverstripe/framework:3.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Conclusion
The user enumeration vulnerability in silverstripe/framework can have serious implications for the security of web applications built using this framework. It is crucial for developers to upgrade to the fixed versions and ensure the protection of user accounts. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
User enumeration is the process of gathering a list of valid usernames or email addresses in a system. It can be used by attackers to target specific accounts or launch further attacks, such as password guessing or phishing.
A timing attack involves measuring the response times of a system to determine certain information. In this case, an attacker can measure the response times of the login or password reset pages to determine if a user exists in the system.
The user enumeration vulnerability in silverstripe/framework can lead to targeted attacks on specific user accounts. Attackers can use the gathered information to launch brute-force attacks on passwords or craft convincing phishing campaigns.
No, not all versions of silverstripe/framework are affected. The vulnerability was introduced in version 3.5.0-rc1 and 3.6.0-rc1. Versions 3.5.5 and 3.6.2 or newer have the vulnerability fixed.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
