MediumGHSA-7cmp-cgg8-4c82CVE-2024-47605
Silverstripe Framework has a XSS via insert media remote file oembed
Published 14 Jan 2025 · Updated 23 Jan 2025
Affected package
silverstripe/frameworkComposer
- Affected
- <5.3.8
- Fixed in
- 5.3.8
Update to the fixed version for your release line, for example:
composer require silverstripe/framework:^5.3.8Details
Impact
When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website.
References
- https://www.silverstripe.org/download/security-releases/cve-2024-47605
Reported by
James Nicoll from Fujitsu Cyber Security Services
Is GHSA-7cmp-cgg8-4c82 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected silverstripe/framework, and gives you the command that fixes it.
References
- Linkgithub.com/silverstripe/silverstripe-asset-admin/security/advisories/GHSA-7cmp-cgg8-4c82
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-47605
- Linkgithub.com/silverstripe/silverstripe-framework/commit/09b5052c86932f273e0d733428c9aade70ff2a4a
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-47605.yaml
- Packagegithub.com/silverstripe/silverstripe-framework
- Linkwww.silverstripe.org/download/security-releases/cve-2024-47605
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.