GHSA-g4hp-pfvf-vm5w SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
Attackers can bypass authentication for development and flush modes by providing empty tokens, potentially causing denial of service or exposing debug information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-g4hp-pfvf-vm5w?
GHSA-g4hp-pfvf-vm5w is an authentication bypass vulnerability in silverstripe/framework, published on 23 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.
For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service.
The fix in this case is to ensure that empty tokens fail the validation check.
Which versions are affected by GHSA-g4hp-pfvf-vm5w?
4 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 3.0.0 | 3.0.14 |
silverstripe/framework Packagist | From 3.0.0 | 3.0.14 |
silverstripe/framework Packagist | From 3.1.0 | 3.1.13 |
silverstripe/framework Packagist | From 3.1.0 | 3.1.13 |
How do I fix GHSA-g4hp-pfvf-vm5w?
Upgrade silverstripe/framework to a fixed version for your release line: 3.0.14 or 3.1.13.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-g4hp-pfvf-vm5w being exploited?
There is no known exploitation of GHSA-g4hp-pfvf-vm5w in the wild and no public exploit code.