CVE-2024-47605 Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin
Attackers can execute arbitrary scripts in the CMS and front-end via unsanitized oEmbed HTML in the insert media feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47605?
CVE-2024-47605 is a medium-severity cross-site scripting vulnerability in silverstripe-asset-admin, published on 14 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-47605?
2 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 5.3.8 |
silverstripe/framework Packagist | All versions | 5.3.8 |
How do I fix CVE-2024-47605?
Upgrade silverstripe/framework to 5.3.8 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47605 being exploited?
There is no known exploitation of CVE-2024-47605 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-7cmp-cgg8-4c82.