PT-2021-11214 · Silverstripe · Silverstripe

Published 2021-06-08 · Updated 2024-03-06 · CVE-2020-26138

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.6.0-rc1

Description: The issue arises when a FormField with square brackets in the field name is used, causing it to skip validation. Specifically, the FileField class, commonly used for file upload, can be coerced into allowing multiple files by adding square brackets to the field name, which is not a supported feature. As a result, validation such as limiting allowed extensions is not applied, and the FileField->saveInto() behaviour is not triggered. This can lead to security issues if custom controller logic relies on validation provided by the Form system.

Recommendations: For SilverStripe versions prior to 4.6.0-rc1, consider disabling the use of square brackets in field names to prevent skipping validation until a patch is available. Restrict access to the FileField class to minimize the risk of exploitation. Avoid using the array notation in field names for file uploads until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-SILVERSTRIPE-2020-26138

CVE-2020-26138

GHSA-7MV4-4XPG-XQ44

Affected Products

Silverstripe

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-26138.yaml · Exploit
• 🔥 https://silverstripe.org/download/security-releases/cve-2020-26138 · Exploit
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7mv4-4xpg-xq44 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26138 · Security Note
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://osv.dev/vulnerability/BIT-silverstripe-2020-26138 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26138 · Vendor Advisory