PT-2024-40438 · Unknown · Htmleditorfield Toolbar

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HtmlEditorField Toolbar (affected versions not specified)

Description The issue concerns the "Add from URL" functionality, which does not properly sanitize URLs on the server side. Specifically, the HtmlEditorField Toolbar action viewfile is called when adding media from a URL, and it retrieves the URL from the FileURL GET parameter without performing any server-side URL sanitization. Although the current logic relies on Oembed to reject potentially dangerous URLs, future changes could potentially break this protection.

Recommendations As a temporary workaround, consider implementing server-side URL sanitization for the FileURL parameter in the viewfile action of HtmlEditorField Toolbar to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-QP29-WCC2-VMPC

Affected Products

Htmleditorfield Toolbar

References · 4

• https://osv.dev/vulnerability/GHSA-qp29-wcc2-vmpc · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-027-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2015-027 · Note