GHSA-52cw-pvq9-9m5v Silverstripe uses TinyMCE which allows svg files linked in object tags
Silverstripe CMS allows SVG files with JavaScript in object tags via TinyMCE, enabling XSS attacks against authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-52cw-pvq9-9m5v?
GHSA-52cw-pvq9-9m5v is a cross-site scripting vulnerability in silverstripe/framework, published on 17 Jul 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
TinyMCE v6 has a configuration value convert_unsafe_embeds set to false which allows svg files containing javascript to be used in <object> or <embed> tags, which can be used as a vector for XSS attacks.
Note that <embed> tags are not allowed by default.
After patching the default value of convert_unsafe_embeds will be set to true. This means that <object> tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved <object> tags. Developers can override this configuration if desired to revert to the original behaviour.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
References:
Which versions are affected by GHSA-52cw-pvq9-9m5v?
2 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 5.2.16 |
silverstripe/framework Packagist | All versions | 5.2.16 |
How do I fix GHSA-52cw-pvq9-9m5v?
Upgrade silverstripe/framework to 5.2.16 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-52cw-pvq9-9m5v being exploited?
There is no known exploitation of GHSA-52cw-pvq9-9m5v in the wild and no public exploit code.