CVE-2020-9309 Silverstripe CMS malicious file upload enables script execution
Attackers can execute scripts via malicious uploads in Silverstripe CMS by exploiting MIME detection flaws in protected or draft files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-9309?
CVE-2020-9309 is a high-severity vulnerability in n/a, published on 15 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for example HTML code in a TXT file). When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Uploads stored as protected or draft files are allowed by default for authorised users only, but can also be enabled through custom logic as well as modules such as silverstripe/userforms. Sites using the previously optional silverstripe/mimevalidator module can configure MIME whitelists rather than extension whitelists, and hence prevent this issue. Sites on the Common Web Platform (CWP) use this module by default, and are not affected.
Weakness: CWE-434
Which versions are affected by CVE-2020-9309?
2 open source packages ship an affected version, including silverstripe/cms. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/cms Packagist | All versions to 4.5.0 | None |
silverstripe/cms Packagist | All versions to 4.5.0 | None |
Products include Silverstripe Mimevalidator, Silverstripe Recipe.
How do I fix CVE-2020-9309?
No fix has been published for CVE-2020-9309 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9309 being exploited?
There is no known exploitation of CVE-2020-9309 in the wild and no public exploit code.
Sources
Also known as GHSA-h77w-655f-6j3m.