GHSA-g43w-98wp-m694 SilverStripe framework XML Quadratic Blowup Attack
An attacker can cause a denial of service in SilverStripe sites by sending malicious XML data that triggers a quadratic blowup attack.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-g43w-98wp-m694?
GHSA-g43w-98wp-m694 is a denial of service vulnerability in silverstripe/framework, published on 23 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A low level vulnerability has been found in the SilverStripe framework, where the Quadratic Blowup Attack could potentially be exploited to affect the performance of a site.
See http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/ for a writeup.
Which versions are affected by GHSA-g43w-98wp-m694?
2 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 3.1.12 |
silverstripe/framework Packagist | All versions | 3.1.12 |
How do I fix GHSA-g43w-98wp-m694?
Upgrade silverstripe/framework to 3.1.12 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-g43w-98wp-m694 being exploited?
There is no known exploitation of GHSA-g43w-98wp-m694 in the wild and no public exploit code.