PT-2021-11213 · Silverstripe · Silverstripe

Published 2021-06-08 · Updated 2024-03-06 · CVE-2020-26136

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.6.0-rc1

Description: The issue concerns the GraphQL module in SilverStripe, which by default accepts basic-auth as an authentication method. This allows bypassing multi-factor authentication (MFA) if the silverstripe/mfa module is installed, although the user's password is still required.

Recommendations: For versions prior to 4.6.0-rc1, consider removing basic-auth as a default authentication method to prevent MFA bypass. If basic-auth is required, it can be re-enabled by adding it to the authenticators key of a schema or on SilverStripeGraphqlAuthHandler. As a temporary workaround, consider disabling the use of basic-auth in the GraphQL module until a patch is available.

Exploit

Fix

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

BIT-SILVERSTRIPE-2020-26136

CVE-2020-26136

GHSA-MG2G-8PWJ-R2J2

Affected Products

Silverstripe

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2020-26136.yaml · Exploit
• 🔥 https://silverstripe.org/download/security-releases/cve-2020-26136 · Exploit
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mg2g-8pwj-r2j2 · Vendor Advisory
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26136 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26136 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-silverstripe-2020-26136 · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory