PT-2024-40477 · Silverstripe · Silverstripe/Framework

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverstripe Framework (affected versions not specified)

Description The issue allows arbitrary global functions to be executed if malicious user input is passed through as the second argument of ViewableData::renderWith. This occurs when the second argument resolves associative arrays as template placeholders. The exploit requires user code to utilize the second argument in renderWith and pass user input directly as a value in an associative array without proper sanitization, such as using Convert::raw2xml(). It is noted that ViewableData::customise is not affected by this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

GHSA-VGXH-X8JV-HMFF

Affected Products

Silverstripe/Framework

References · 5

• https://osv.dev/vulnerability/GHSA-vgxh-x8jv-hmff · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-006-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/6f50728b185e62c0087a58b295a015cb13276911 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2018-006 · Note