Cythera Cyber Security

Silverstripe – Cross-Site Scripting (XSS) Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been uncovered in the Silverstripe CMS admin interface. The flaw lies in how user input is processed within the form messages module, allowing for potential malicious script injection.

Talk to an expert

The client

Silverstripe, a widely used open-source CMS for managing websites, was found to have a Cross-Site Scripting (XSS) vulnerability by Leo Diamat during a client engagement. The issue resided within the Silverstripe framework and was assigned medium severity (CVE-2024-53277) following disclosure. This advisory explores the technical root cause, potential exploitation, and risks associated with the flaw. The Silverstripe security team acted quickly to investigate and released a patch to resolve the issue.

The vulnerability

Silverstripe’s FormMessage class is designed to display alerts and notifications such as success or warning messages within forms. However, a flaw in how user input was processed allowed attackers to inject malicious scripts. While user input was correctly sanitised when a form entry was created, the sanitisation was inconsistent when the same entry triggered a deletion notification. This gap enabled a stored XSS vulnerability, where scripts could be executed during the deletion process — potentially allowing attackers to escalate privileges or exfiltrate sensitive data.

Proof of Concept

To illustrate this vulnerability, the following XSS payload was used when submitting an entry through the Silverstripe Form Message functionality.

Initially, the payload does not execute because Silverstripe applies input sanitisation after the entry is created. However, when the entry is deleted, the resulting notification fails to sanitise the content — causing the XSS payload to execute.

‍

Potential Impact

A malicious actor with low-level access to the CMS could exploit this XSS flaw by injecting a payload into form messages. If an administrator deletes that entry, the script executes within their browser session, potentially allowing privilege escalation or theft of sensitive data under the administrator’s permissions.

‍

Remediation

The vulnerability is resolved in Silverstripe version 5.3.8 and above. Users are strongly advised to upgrade to the latest release. Full details are available on the Silverstripe Security Advisory for CVE-2024-53277.

‍

Vulnerability Disclosure Timeline

26 Nov 2024 – Issue reported to Silverstripe
15 Jan 2025 – Patch released and CVE-2024-53277 assigned
22 Jan 2025 – Public disclosure

‍

CIO

Government Agency

Cythera operates as an extension of our team. When we call there is an immediate response and the person that answers our call is the person that resolves our issue. Cythera understands our network, and more importantly, has taken the time to understand our business. We find it easy to work with Cythera. They are approachable, flexible and have taken the time to build deep relationships with our team. It is a partnership and friendship. Cythera’s personalised, highly specialised services makes all the difference. We would recommend Cythera to anyone in the industry looking for a managed services partner.

Expert methods

We have the tools to pinpoint risks

Whether it’s hidden vulnerabilities or patterns you might miss, we help you stay one step ahead and make confident, informed decisions. Understand how our services can help your business uncover critical risks

Talk to an expert

Employee Cyber Training & Awareness

Your people are your first line of defence. Our cyber training builds awareness sharpens instincts and turns everyday staff into assets.

Advisory

When clarity is critical and stakes are high, our advisory services deliver strategic, executive-level security expertise that empowers decision-making and resilient operations.

Are you experiencing a security breach?

Incident Response

1300 298 437