PT-2020-20577 · Silverstripe · Silverstripe Cms+2

Published 2020-07-15 · Updated 2022-05-24 · CVE-2020-9309

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverstripe CMS versions prior to 4.6

Description The issue allows for script execution from malicious upload contents under allowed file extensions. For example, HTML code in a TXT file can be executed when stored as protected or draft files, due to MIME detection causing browsers to execute the file contents. This can occur when uploads are stored as protected or draft files, which are allowed by default for authorized users only, but can also be enabled through custom logic or modules like silverstripe/userforms.

Recommendations For Silverstripe CMS versions prior to 4.6, consider configuring MIME whitelists rather than extension whitelists to prevent this issue, or use the silverstripe/mimevalidator module which can provide this functionality. As a temporary workaround, consider restricting the upload of files with potentially executable contents until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-9309

GHSA-H77W-655F-6J3M

Affected Products

Silverstripe Cms

Silverstripe/Mimevalidator

Silverstripe-Userforms

References · 5

• https://osv.dev/vulnerability/CVE-2020-9309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9309 · Security Note
• https://silverstripe.org/download/security-releases/CVE-2020-9309 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h77w-655f-6j3m · Vendor Advisory
• https://github.com/silverstripe/silverstripe-cms · Note