Vulnerability in silverstripe/framework: Upload of Dangerous File Types
Summary
GHSA-vcg6-8fxc-x5cq: silverstripe/framework allows upload of dangerous file types. Affects silverstripe/framework across 3 version ranges.
>= 3.6.5-rc1, < 3.6.6
>= 4.0.3-rc1, < 4.0.4
>= 4.1.0-rc1, < 4.1.1
Fixed in 3.6.6, 4.0.4 or 4.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is a PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including file upload capabilities. However, a vulnerability has been discovered in the framework that allows the upload of dangerous file types. This can potentially enable a malicious user to upload files that can be executed within the security context of the website. The framework has addressed this issue by removing the ability to upload certain file types in the default configuration.
Vulnerability Detail
The vulnerability in silverstripe/framework arises from the presence of potentially dangerous file types in the File.allowed_extensions configuration. These file types, such as .css, .js, .potm, .dotm, .xltm, and .jar, can be exploited by a malicious CMS user to upload files that may contain malicious code. When these files are executed within the website's security context, they can lead to various security risks, including remote code execution and unauthorized access to sensitive data. The framework has released updates to mitigate this vulnerability by removing the ability to upload these file types and denying access to existing uploads with these extensions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.6.5-rc1, < 3.6.63.6.6composer require silverstripe/framework:3.6.6 -
>= 4.0.3-rc1, < 4.0.44.0.4composer require silverstripe/framework:4.0.4 -
>= 4.1.0-rc1, < 4.1.14.1.1composer require silverstripe/framework:4.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to implement additional security measures such as input validation and file type checking on the server-side to prevent the upload of dangerous file types. This can be done by implementing appropriate file upload validation logic in the application code.
Conclusion
The vulnerability in silverstripe/framework that allows the upload of dangerous file types has been addressed by removing the ability to upload certain file types in the default configuration. It is crucial to update the framework to the fixed versions and follow the recommended security guidelines to mitigate the risk of this vulnerability. For additional support and guidance, you can contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
This vulnerability allows a malicious CMS user to upload dangerous file types, which can lead to various security risks, including remote code execution and unauthorized access to sensitive data.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the recommended fixes and keep the framework up to date to mitigate any potential risks.
Yes, you can add or remove file extensions from the allowed list by following the security guidelines for the Common Web Platform and the File Security guide for SilverStripe 4. It is important to carefully consider the security implications before making any changes to the allowed extensions.
For further support on vulnerability remediation and assistance with securing your application, you can reach out to info@devnack.com. They can provide guidance and help ensure your application is protected against this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
