Silverstripe Framework: SVG Object Tag XSS Vulnerability
Summary
GHSA-52cw-pvq9-9m5v: Silverstripe uses TinyMCE which allows svg files linked in object tags. Affects silverstripe/framework versions < 5.2.16. Fixed in 5.2.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe Framework is an open-source PHP web application framework used for building websites and web applications. It provides a flexible and extensible platform for content management and development. The framework includes various components, including the TinyMCE editor for rich text editing. However, a vulnerability has been discovered in the TinyMCE editor used by Silverstripe, which allows for potential cross-site scripting (XSS) attacks through SVG files linked in object tags.
Vulnerability Detail
The vulnerability arises from the configuration value convert_unsafe_embeds in TinyMCE v6, which is set to false by default in Silverstripe. This allows for the use of SVG files containing JavaScript code in <object> or <embed> tags, which can be exploited to execute XSS attacks. Although <embed> tags are not allowed by default, <object> tags can be used as a vector for the attack. The impact of this vulnerability is considered medium, given the usage of TinyMCE in Silverstripe CMS.
How To Fix
Minimum fixed version
5.2.16
This is the first release that contains the fix.
composer require silverstripe/framework:5.2.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Silverstripe Framework, when using TinyMCE v6, is vulnerable to XSS attacks through SVG files linked in object tags. To mitigate this vulnerability, it is recommended to update to Silverstripe framework version 5.2.16 or later, which includes a patch that changes the default behavior of TinyMCE. This change prevents the execution of JavaScript code within SVG files, reducing the risk of XSS attacks. Developers should assess the impact on existing pages that rely on <object> tags before applying the update.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability allows for potential XSS attacks through SVG files linked in object tags. This can lead to unauthorized execution of JavaScript code on affected websites, potentially compromising user data and system integrity.
The vulnerability arises from the default configuration value convert_unsafe_embeds in TinyMCE v6, which allows the use of SVG files containing JavaScript code in <object> tags.
The vulnerability is considered to have a moderate severity with a CVSS score of 5.4. While it has the potential for XSS attacks, the impact is limited to the usage of TinyMCE in Silverstripe CMS.
To fix this vulnerability, you should update the Silverstripe framework to version 5.2.16 or later. This update includes the patch that changes the default value of convert_unsafe_embeds to true in TinyMCE.
Yes, developers can override the configuration value convert_unsafe_embeds to revert to the original behavior of <object> tags. However, it's important to assess the security implications before making this change.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
