GHSA-589q-75r3-mfq4 — Silverstripe has Incorrect Default Permissions

The advisory, in context

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited (e.g., through pagination), resulting in records that should have failed a permission check being added to the final result set. GraphQL endpoints are configured by default (e.g., for assets), but the admin/graphql endpoint is access protected by default. This limits the vulnerability to all authenticated users, including those with limited permissions (e.g., where viewing records exposed through admin/graphql requires administrator permissions). However, if custom GraphQL endpoints have been configured for a specific implementation (usually under /graphql), this vulnerability could also be exploited through unauthenticated requests. This vulnerability only applies to reading records; it does not allow unauthorised changing of records.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

silverstripe/recipe-cms Packagist

Ecosystem versions

From 4.5.0 before 4.5.3

Fixed in 4.5.3

3 explicitly affected versions

4.5.0, 4.5.1, 4.5.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.5.0"
        },
        {
          "fixed": "4.5.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "4.5.0",
    "4.5.1",
    "4.5.2"
  ]
}

silverstripe/graphql Packagist

Ecosystem versions

From 3.2.0 before 3.2.4

Fixed in 3.2.4

4 explicitly affected versions

3.2.0, 3.2.1, 3.2.2, 3.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.2.0"
        },
        {
          "fixed": "3.2.4"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.2.0",
    "3.2.1",
    "3.2.2",
    "3.2.3"
  ]
}

Set up in your agent.

Investigate in your agent.

Silverstripe has Incorrect Default Permissions

The advisory, in context

Affected packages

References