GHSA-mqf3-qpc3-g26q Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
Attackers can execute arbitrary scripts via reflected XSS in error messages when Silverstripe is misconfigured in dev mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-mqf3-qpc3-g26q?
GHSA-mqf3-qpc3-g26q is a cross-site scripting vulnerability in silverstripe/framework, published on 14 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
> [!IMPORTANT] > This vulnerability only affects sites which are in the "dev" environment mode. If your production website is in "dev" mode, it has been misconfigured, and you should immediately swap it to "live" mode. > See https://docs.silverstripe.org/en/developer_guides/debugging/environment_types/ for more information.
If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.
References
Reported by
Gaurav Nayak from Chaleit
Which versions are affected by GHSA-mqf3-qpc3-g26q?
2 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 5.3.8 |
silverstripe/framework Packagist | All versions | 5.3.8 |
How do I fix GHSA-mqf3-qpc3-g26q?
Upgrade silverstripe/framework to 5.3.8 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-mqf3-qpc3-g26q being exploited?
There is no known exploitation of GHSA-mqf3-qpc3-g26q in the wild and no public exploit code.