MediumGHSA-j3m6-gvm8-mhvwCVE-2023-49783

No permission checks for editing/deleting records with CSV import form

Published 23 Jan 2024 · Updated 16 Feb 2024

Affected packages

silverstripe/adminComposer
Affected
>=1.0.0 <1.13.19
Fixed in
1.13.19
Update to the fixed version for your release line, for example:composer require silverstripe/admin:^1.13.19
silverstripe/adminComposer
Affected
>=2.0.0 <2.1.8
Fixed in
2.1.8
Update to the fixed version for your release line, for example:composer require silverstripe/admin:^2.1.8

Details

Impact

Users who don't have edit or delete permissions for records exposed in a ModelAdmin can still edit or delete records using the CSV import form, provided they have create permissions.

The likelyhood of a user having create permissions but _not_ having edit or delete permissions is low, but it _is_ possible.

Note that this doesn't affect any ModelAdmin which has had the import form disabled via the `showImportForm` public property, nor does it impact the SecurityAdmin section.

Action may be required

If you have a custom implementation of `BulkLoader`, you should update your implementation to respect permissions when the return value of `getCheckPermissions()` is true.

If you are using any BulkLoader in your own project logic, or maintain a module which uses it, you should consider passing true to `setCheckPermissions()` if the data is provided by users.

Base CVSS: 4.3 Reported by: Guy Sartorelli from Silverstripe

References

  • https://www.silverstripe.org/download/security-releases/CVE-2023-49783

Is GHSA-j3m6-gvm8-mhvw in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected silverstripe/admin, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.