Cross-Site Scripting (XSS) in Silverstripe Queued Job Task
Vulnerability Summary
An XSS vulnerability was discovered in the CreateQueuedJobTask functionality of Silverstripe. The issue lies in how the name parameter is handled when a new job is created through the /dev/tasks/CreateQueuedJobTask endpoint. The affected line in the source code directly echoes the name parameter into the response without any sanitisation.
This allows an attacker to inject JavaScript payloads via the name parameter. When an administrator visits the job creation link with this malicious input, the JavaScript is executed in their browser.
For example, a payload crafted to include a simple alert (like a script tag that calls alert(1)) would result in the browser displaying a popup when the administrator opens the URL. This confirms that the input is executed as code rather than displayed as plain text.
Exploitation and Proof of Concept
An attacker could create a malicious link that includes the JavaScript payload within the name parameter and trick an authenticated administrator into clicking on it. If the system is running in Development Mode (Dev Mode), the payload will execute immediately upon visiting the link. If the system is in Live Mode, an additional click on "Run the action" would be required to trigger the exploit.
Building upon this XSS, a proof of concept was developed to demonstrate CSRF-based account creation using the administrator's privileges. This PoC performs the following:
- Makes a GET request to retrieve the SecurityID, which serves as a CSRF token in Silverstripe.
- Constructs a POST request to submit a form that creates a new administrator account using controlled values for the email and password.
- Once the form is submitted and the exploit succeeds, the attacker can log into the admin panel using the newly created credentials.
- This attack chain leads to full administrative control over the Silverstripe application.
Impact
If exploited, this vulnerability could result in a complete compromise of the Silverstripe application. An attacker may:
- Add or remove admin users
- Modify or delete site content
- Steal sensitive user or system data
- Inject persistent malware or defacements
- Disrupt or shut down the website entirely
Mitigation
Silverstripe has released a patch addressing this issue. All affected installations should be upgraded as soon as possible. Sanitisation was added to ensure user input passed through the name parameter is not executed as HTML or JavaScript.
More details on the fix are available on Silverstripe’s official security advisory page for CVE-2021-27938.
Disclosure Timeline
- 01 March 2021 – Vulnerability reported to Silverstripe
- 01 March 2021 – Report acknowledged by Silverstripe
- 02 March 2021 – Issue validated by maintainers
- 15 March 2021 – Patch released and CVE-2021-27938 assigned
