Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
Silverstripe can be tricked into modifying database without logging in
published 2 years ago
Summary
Silverstripe's /dev/build/defaults page doesn't require a login, which means an attacker can potentially modify database settings without authenticating. This could allow them to make changes to your site's database structure and gain insight into your site's configuration. You should update Silverstripe to ensure this page requires a login, just like the /dev/build page does.
What to do
- Update silverstripe framework to version 3.2.2.
- Update silverstripe framework to version 3.3.0.
- Update silverstripe framework to version 3.1.17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | silverstripe | framework |
>= 3.2.0, <= 3.2.1 >= 3.3.0-beta1, < 3.3.0 <= 3.1.16 Fix: upgrade to 3.2.2
|
Original advisory text
Silverstripe Missing security check on dev/build/defaults
The buildDefaults method on DevelopmentAdmin is missing a permission check.
In live mode, if you access /dev/build, you are requested to login first. However, if you access /dev/build/defaults, then the action is performed without any login check. This should be protected in the same way that /dev/build is.
The buildDefaults view is requireDefaultRecords() on each DataObject class, and hence has the potential to modify database state. It also lists all modified tables, allowing attackers more insight into which modules are used, and how the database tables are structured.
In live mode, if you access /dev/build, you are requested to login first. However, if you access /dev/build/defaults, then the action is performed without any login check. This should be protected in the same way that /dev/build is.
The buildDefaults view is requireDefaultRecords() on each DataObject class, and hence has the potential to modify database state. It also lists all modified tables, allowing attackers more insight into which modules are used, and how the database tables are structured.
References
- https://github.com/silverstripe/silverstripe-framework/commit/15d4db3b4a7dbc9a7e...
- https://github.com/silverstripe/silverstripe-framework/commit/3398f670d881447f87...
- https://github.com/silverstripe/silverstripe-framework/commit/5d2fc0d7cac4ce686f...
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/fra...
- https://www.silverstripe.org/download/security-releases/ss-2015-028
- https://github.com/advisories/GHSA-x5w2-wcr8-9q45
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-425Direct Request ('Forced Browsing')
Timeline
Published23 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-x5w2-wcr8-9q45 · GHSA
Track software like this
Free during beta