Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter
Published 23 May 2024 · Updated 28 Nov 2024
Affected packages
- Affected
- <3.1.17
- Fixed in
- 3.1.17
composer require silverstripe/framework:^3.1.17- Affected
- >=3.2.0 <3.2.2
- Fixed in
- 3.2.2
composer require silverstripe/framework:^3.2.2- Affected
- >=3.3.0-beta1 <3.3.0
- Fixed in
- 3.3.0
composer require silverstripe/framework:^3.3.0Details
GridField does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites. Amongst other default CMS interfaces, GridField is used for management of groups, users and permissions in the CMS.
The resolution for this issue is to ensure that all gridFieldAlterAction submissions are checked for the SecurityID token during submission.
Is GHSA-2hpc-mf4q-j885 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected silverstripe/framework, and gives you the command that fixes it.
References
- Linkgithub.com/silverstripe/silverstripe-framework/commit/013524af5069bb0cf909853f04418d9bef56d18c
- Linkgithub.com/silverstripe/silverstripe-framework/commit/56e92f5a32e45849cc9361c8603c31d7010c9d36
- Linkgithub.com/silverstripe/silverstripe-framework/commit/e2c77c5a8f13e901c51a3684210811559b592f0c
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-002-1.yaml
- Packagegithub.com/silverstripe/silverstripe-framework
- Linkwww.silverstripe.org/download/security-releases/ss-2016-002
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.