GHSA-52cx-hpc5-cxwc silverstripe/framework missing ACL on reports
Authenticated users with CMS access can view any report by guessing URLs, bypassing intended view restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-52cx-hpc5-cxwc?
GHSA-52cx-hpc5-cxwc is a missing authorization vulnerability in silverstripe/framework, published on 27 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The SS_Report, and the reports CMS section only checks canView() when listing the reports that can be viewed by the current user.
It does not (and should) perform canView checks when the report is actually viewed, so if you know the URL to a report and can otherwise access the Reports section of the CMS, you can view any report.
Which versions are affected by GHSA-52cx-hpc5-cxwc?
8 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 3.1.19-rc1 | 3.1.20 |
silverstripe/framework Packagist | From 3.1.19-rc1 | 3.1.20 |
silverstripe/framework Packagist | From 3.2.4-rc1 | 3.2.5 |
silverstripe/framework Packagist | From 3.2.4-rc1 | 3.2.5 |
silverstripe/framework Packagist | From 3.3.2-rc1 | 3.3.3 |
silverstripe/framework Packagist | From 3.3.2-rc1 | 3.3.3 |
2 more packages
silverstripe/framework Packagist | From 3.4.0-rc1 | 3.4.1 |
silverstripe/framework Packagist | From 3.4.0-rc1 | 3.4.1 |
How do I fix GHSA-52cx-hpc5-cxwc?
Upgrade silverstripe/framework to a fixed version for your release line: 3.1.20, 3.2.5, 3.3.3 or 3.4.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-52cx-hpc5-cxwc being exploited?
There is no known exploitation of GHSA-52cx-hpc5-cxwc in the wild and no public exploit code.