GHSA-crr3-h4m8-7f56 silverstripe/framework vulnerable to member disclosure in login form
An attacker can enumerate valid user accounts by observing differences in login lockout messages for existing versus non-existent users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-crr3-h4m8-7f56?
GHSA-crr3-h4m8-7f56 is a vulnerability in silverstripe/framework, published on 27 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a user ID enumeration vulnerability in our brute force error messages.
- Users that don't exist in will never get a locked out message
- Users that do exist, will get a locked out message
This means an attacker can infer or confirm user details that exist in the member table.
This issue has been resolved by ensuring that login attempt logging and lockout process works equivalently for non-existent users as it does for existant users.
This is a regression of SS-2017-002.
Which versions are affected by GHSA-crr3-h4m8-7f56?
4 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 4.0.0-rc1 | 4.0.4 |
silverstripe/framework Packagist | From 4.0.0-rc1 | 4.0.4 |
silverstripe/framework Packagist | From 4.1.0-rc1 | 4.1.1 |
silverstripe/framework Packagist | From 4.1.0-rc1 | 4.1.1 |
How do I fix GHSA-crr3-h4m8-7f56?
Upgrade silverstripe/framework to a fixed version for your release line: 4.0.4 or 4.1.1.
Is GHSA-crr3-h4m8-7f56 being exploited?
There is no known exploitation of GHSA-crr3-h4m8-7f56 in the wild and no public exploit code.