MediumGHSA-52cw-pvq9-9m5v

Silverstripe uses TinyMCE which allows svg files linked in object tags

Published 17 Jul 2024 · Updated 1 Dec 2024

Affected package

Affected: <5.2.16
Fixed in: 5.2.16

Update to the fixed version for your release line, for example:composer require silverstripe/framework:^5.2.16

Details

Impact

TinyMCE v6 has a configuration value convert_unsafe_embeds set to false which allows svg files containing javascript to be used in <object> or <embed> tags, which can be used as a vector for XSS attacks.

Note that <embed> tags are not allowed by default.

After patching the default value of convert_unsafe_embeds will be set to true. This means that <object> tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved <object> tags. Developers can override this configuration if desired to revert to the original behaviour.

We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.

References:

https://www.silverstripe.org/download/security-releases/ss-2024-001
https://github.com/advisories/GHSA-5359-pvf2-pw78

Is GHSA-52cw-pvq9-9m5v in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected silverstripe/framework, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.