Vulnerability Discovery
This vulnerability stemmed from weak server-side validation and over-reliance on client-side checks, which could be bypassed. When content was published through a browser, HTML entities were encoded correctly to prevent execution. However, if the same request was made directly—using tools like Burp Suite or Curl—it could skip client-side validation and execute malicious code.
An attacker could submit a specially crafted payload in the Content parameter of a POST request to insert malicious code into a content block. The payload used an <object> tag with base64-encoded HTML content. When the browser loaded the page, it decoded and executed the embedded script, triggering an alert box with the message XSS, demonstrating successful code execution.
Potential Impact
This stored XSS vulnerability would execute when someone viewed the affected page on the public-facing website. Because the Silverstripe admin panel also renders previews, the payload would run there too.
If an attacker gained access to a low-privileged CMS account, they could potentially use this vulnerability to escalate privileges. For example, the payload could be used to create a new administrator account or redirect an admin to a phishing page. However, stealing session tokens was not possible due to the use of the HttpOnly flag.
How to Fix It
Silverstripe has released patches for all affected versions. More details are available on their security advisory page.
Vulnerability Disclosure Timeline
- 10 January 2024 – Issue reported to Silverstripe
- 7 May 2024 – Bug report acknowledged
- 8 July 2024 – Issue validated
- 18 July 2024 – Patch released and CVE assigned
