PT-2025-2773 · Silverstripe · Silverstripe Asset-Admin+1

James Nicoll · Published 2025-01-14 · Updated 2025-01-15 · CVE-2024-47605

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: silverstripe-asset-admin versions prior to 5.3.8 silverstripe/framework versions prior to 5.3.8

Description: The issue arises when using the "insert media" functionality, where the linked oEmbed JSON includes an HTML attribute that replaces the embed shortcode. Since the HTML is not sanitized before replacing the shortcode, it allows a script payload to be executed on both the CMS and the front-end of the website.

Recommendations: For silverstripe-asset-admin versions prior to 5.3.8, upgrade to version 5.3.8 or later. For silverstripe/framework versions prior to 5.3.8, upgrade to version 5.3.8 or later. As a temporary workaround, consider disabling the "insert media" functionality until a patch is available. Restrict access to the oEmbed JSON endpoint to minimize the risk of exploitation. Avoid using the insert media functionality in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47605

GHSA-7CMP-CGG8-4C82

Affected Products

Silverstripe Asset-Admin

Silverstripe/Framework

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47605.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-47605.yaml · Exploit
• 🔥 https://exploit-db.com/exploits/52199 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47605 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47605 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cmp-cgg8-4c82 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework/commit/09b5052c86932f273e0d733428c9aade70ff2a4a · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://github.com/silverstripe/silverstripe-asset-admin/security/advisories/GHSA-7cmp-cgg8-4c82 · Note
• https://t.me/cvedetector/15385 · Telegram Post
• https://silverstripe.org/download/security-releases/cve-2024-47605 · Note
• https://twitter.com/CVEnew/status/1879490172003422336 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879441418470486061 · Twitter Post
• https://t.me/cvenotify/107400 · Telegram Post