Bastion Security

Silverstripe - Cross-Site Scripting (XSS) Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in the administrator panel of Silverstripe CMS, specifically in the handling of the user input within the form messages module.

Talk to an expert

The client

Silverstripe is a popular open-source CMS for creating and maintaining websites. During a client engagement, Leo Diamat discovered a Cross-Site Scripting (XSS) vulnerability within the Silverstripe framework. After reporting the issue to Silverstripe, it was classified as medium severity (CVE-2024-53277). This advisory provides an in-depth look at the vulnerability, detailing its technical aspects, exploitation methods, and the potential risks to users and organisations.

The Silverstripe team responded promptly, identified the root cause, and issued a fix to address the vulnerability.

‍

The vulnerability

Silverstripe offers the FormMessage class to display notifications and alerts within its forms, such as success messages or warnings. However, improper handling of user input in these messages created a pathway for attackers to inject malicious scripts. This meant that certain content rendered as a notification could execute as code if not adequately sanitised.

An XSS vulnerability arises when a user creates a form entry with malicious input. While the input is sanitised after the entry is created, it is not properly sanitised in the delete notification. This inconsistency in sanitisation results in the execution of scripts during the deletion process, which could be exploited by attackers to escalate privileges and exfiltrate sensitive data

‍

January 22, 2025

Proof of concept

To demonstrate this issue, the following XSS payload can be used when creating an entry that utilises the Silverstripe Form Message.

After creating the entry, the payload will not execute due to sanitisation being applied. However, when the entry is deleted, a deletion notification appears that does not undergo sanitisation, which results in the execution of the XSS payload.

‍

Potential impact

A threat actor who has gained access to a low-privilege user account on the CMS could craft an XSS payload to escalate their privileges or exfiltrate sensitive data. This could occur when an administrator deletes an entry containing the malicious payload, causing it to execute within the context of the administrator’s browser session and permissions.

How to fix it

Upgrade to Silverstripe 5.3.8 or greater. Silverstripe has released the patch for all versions affected. More details could be found here.

Vulnerability Disclosure Timeline

26/11/2024 - Issue reported to Silverstripe
15/01/2025 - Patch released and CVE assigned (CVE-2024-53277)
22/01/2025 - Publicly Disclosed

‍

Service Development Manager

Government Agency

"Great service, clear, detailed and precise information on what our vulnerabilities were and what needs addressing. Couldn't have been easier to deal with and very professional."

Expert methods

We have the tools to pinpoint risks

Whether it’s hidden vulnerabilities or patterns you might miss, we help you stay one step ahead and make confident, informed decisions. Understand how our services can help your business uncover critical risks

Talk to an expert

Employee Cyber Training & Awareness

Your people are your first line of defence. Our cyber training builds awareness, sharpens instincts and turns everyday staff into assets.

Advisory

When clarity is critical and stakes are high, our advisory services deliver strategic, executive-level security expertise that empowers decision-making

Are you experiencing a security breach?

Incident Response

+64 4 281 7534