GHSA-cwgq-83w5-8jfq silverstripe/framework has possible denial of service attack vector when flushing
An unauthenticated attacker can trigger a denial of service via the dev/build system controller in SilverStripe framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-cwgq-83w5-8jfq?
GHSA-cwgq-83w5-8jfq is a denial of service vulnerability in silverstripe/framework, published on 28 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A possible denial of service attack vector has been identified in the dev/build system controller.
dev/build now has its own URL token, similar to flushtoken, to ensure users are authenticated when running dev/build outside of dev environments.
Which versions are affected by GHSA-cwgq-83w5-8jfq?
6 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 4.0.0-rc1 | 4.0.5 |
silverstripe/framework Packagist | From 4.0.0-rc1 | 4.0.5 |
silverstripe/framework Packagist | From 4.1.0-rc1 | 4.1.3 |
silverstripe/framework Packagist | From 4.1.0-rc1 | 4.1.3 |
silverstripe/framework Packagist | From 4.2.0-rc1 | 4.2.2 |
silverstripe/framework Packagist | From 4.2.0-rc1 | 4.2.2 |
How do I fix GHSA-cwgq-83w5-8jfq?
Upgrade silverstripe/framework to a fixed version for your release line: 4.0.5, 4.1.3 or 4.2.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-cwgq-83w5-8jfq being exploited?
There is no known exploitation of GHSA-cwgq-83w5-8jfq in the wild and no public exploit code.