GHSA-hq4p-5mpr-jj9m Silverstripe XSS in dev/build returnURL Parameter
An XSS vulnerability in the dev/build returnURL parameter allows attackers to redirect users to malicious sites, requiring a framework upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-hq4p-5mpr-jj9m?
GHSA-hq4p-5mpr-jj9m is a cross-site scripting vulnerability in silverstripe/framework, published on 23 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A XSS risk exists in the returnURL parameter passed to dev/build. An unvalidated url could cause the user to redirect to an unverified third party url outside of the site.
This issue is resolved in framework 3.1.14 stable release.
Which versions are affected by GHSA-hq4p-5mpr-jj9m?
2 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 3.1.14 |
silverstripe/framework Packagist | All versions | 3.1.14 |
How do I fix GHSA-hq4p-5mpr-jj9m?
Upgrade silverstripe/framework to 3.1.14 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-hq4p-5mpr-jj9m being exploited?
There is no known exploitation of GHSA-hq4p-5mpr-jj9m in the wild and no public exploit code.