Sensitive Data Disclosure in silverstripe/framework's install.php Script
Summary
GHSA-r3pr-fh25-wrfc: When accessing the install.php script it is possible to extract any pre-configured database or default admin account password by viewing the source of the page, and inspecting the value property of the password fields. Affects silverstripe/framework versions >= 4.0.0-rc1, < 4.0.1. Fixed in 4.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is an open-source PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including database management. The install.php script is used during the installation process to configure the database and set up the default admin account.
Vulnerability Detail
The install.php script in silverstripe/framework suffers from a vulnerability that allows an attacker to extract sensitive data. When accessing the script, an attacker can view the page source and inspect the 'value' property of the password fields. This allows them to retrieve any pre-configured database or default admin account password. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.0.1
This is the first release that contains the fix.
composer require silverstripe/framework:4.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify the install.php script to remove the pre-populated values from the password fields. This can be done by editing the source code of the script and removing the 'value' attribute from the password input tags.
Conclusion
The sensitive data disclosure vulnerability in silverstripe/framework's install.php script can lead to the exposure of critical information, posing a risk to the security of the application. It is crucial to update to version 4.0.1 or later to fix the vulnerability. Alternatively, users can apply the provided workaround until the update is implemented. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability allows an attacker to extract sensitive data, such as database credentials or default admin account passwords. This information can be used to gain unauthorized access to the application and potentially compromise its security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the moment. However, it is important to apply the recommended fix or workaround to mitigate the risk of exploitation.
No, only versions prior to 4.0.1 are affected by this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
Yes, as mentioned in the workaround section, you can manually edit the install.php script and remove the 'value' attribute from the password input tags. However, it is still recommended to update to the latest version of silverstripe/framework to fully address the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
