GHSA-5f5v-5c3v-gw5v Silverstripe IE requests not properly behaving with rewritehashlinks
Silverstripe CMS allows cross-site scripting via unencoded URL parameters in Internet Explorer requests, enabling attackers to inject malicious JavaScript.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-5f5v-5c3v-gw5v?
GHSA-5f5v-5c3v-gw5v is a cross-site scripting vulnerability in silverstripe/framework, published on 23 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Non IE browsers don’t appear to be affected, but I haven’t tested a wide range of browsers to be sure
Requests that come through from IE do NOT appear to encode all entities in the URL string, meaning they are inserted into output content directly by SSViewer::process() when rewriting hashlinks, as it directly outputs $_SERVER[‘REQUEST_URI’]
Example IE8 request 127.0.0.1 - - [18/Jun/2014:14:13:42 +1000] “GET /site/cars/brands/toyota?one=1\”onmouseover=\”alert(‘things’);\” HTTP/1.1” 200
Example FF request 127.0.0.1 - - [18/Jun/2014:14:14:22 +1000] “GET /site/cars/brands/toyota?one=1%22onmouseover=%22alert(%27things%27);%22 HTTP/1.1” 200
This causes any hash anchor to have the JS code inserted into the page as-is.
Which versions are affected by GHSA-5f5v-5c3v-gw5v?
4 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 3.0.13 |
silverstripe/framework Packagist | All versions | 3.0.13 |
silverstripe/framework Packagist | From 3.1.0 | 3.1.12 |
silverstripe/framework Packagist | From 3.1.0 | 3.1.12 |
How do I fix GHSA-5f5v-5c3v-gw5v?
Upgrade silverstripe/framework to a fixed version for your release line: 3.0.13 or 3.1.12.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-5f5v-5c3v-gw5v being exploited?
There is no known exploitation of GHSA-5f5v-5c3v-gw5v in the wild and no public exploit code.