GHSA-x5w2-wcr8-9q45 — Silverstripe Missing security check on dev/build/defaults

The advisory, in context

The buildDefaults method on DevelopmentAdmin is missing a permission check.

In live mode, if you access /dev/build, you are requested to login first. However, if you access /dev/build/defaults, then the action is performed without any login check. This should be protected in the same way that /dev/build is. The buildDefaults view is requireDefaultRecords() on each DataObject class, and hence has the potential to modify database state. It also lists all modified tables, allowing attackers more insight into which modules are used, and how the database tables are structured.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

silverstripe/framework Packagist

Ecosystem versions

Earlier releases before 3.1.17

Fixed in 3.1.17

68 explicitly affected versions

2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.9, 2.5.0, 3.0.10, 3.0.10-rc1, 3.0.11, 3.0.11-rc1, 3.0.12, 3.0.13, 3.0.14, 3.0.2.1, 3.0.3, 3.0.3-rc1, 3.0.3-rc2, 3.0.4, 3.0.5, 3.0.6, 3.0.6-rc1, 3.0.6-rc2, 3.0.7, 3.0.7-rc1, 3.0.8, 3.0.9, 3.0.9-rc1, 3.1.0, 3.1.0-beta1, 3.1.0-beta2, 3.1.0-beta3, 3.1.0-rc1, 3.1.0-rc2, 3.1.0-rc3, 3.1.1, 3.1.10, 3.1.10-rc1, 3.1.10-rc2, 3.1.11, 3.1.11-rc1, 3.1.12, 3.1.13, 3.1.13-rc1, 3.1.14, 3.1.14-rc1, 3.1.15, 3.1.16, 3.1.16-rc1, 3.1.17-rc1, 3.1.17-rc2, 3.1.2, 3.1.2-rc1, 3.1.3, 3.1.3-rc1, 3.1.3-rc2, 3.1.4, 3.1.4-rc1, 3.1.5, 3.1.5-rc1, 3.1.6, 3.1.6-rc1, 3.1.6-rc2, 3.1.6-rc3, 3.1.7, 3.1.7-rc1, 3.1.8, 3.1.9, 3.1.9-rc1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "3.1.17"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.4.10",
    "2.4.11",
    "2.4.12",
    "2.4.13",
    "2.4.9",
    "2.5.0",
    "3.0.10",
    "3.0.10-rc1",
    "3.0.11",
    "3.0.11-rc1",
    "3.0.12",
    "3.0.13",
    "3.0.14",
    "3.0.2.1",
    "3.0.3",
    "3.0.3-rc1",
    "3.0.3-rc2",
    "3.0.4",
    "3.0.5",
    "3.0.6",
    "3.0.6-rc1",
    "3.0.6-rc2",
    "3.0.7",
    "3.0.7-rc1",
    "3.0.8",
    "3.0.9",
    "3.0.9-rc1",
    "3.1.0",
    "3.1.0-beta1",
    "3.1.0-beta2",
    "3.1.0-beta3",
    "3.1.0-rc1",
    "3.1.0-rc2",
    "3.1.0-rc3",
    "3.1.1",
    "3.1.10",
    "3.1.10-rc1",
    "3.1.10-rc2",
    "3.1.11",
    "3.1.11-rc1",
    "3.1.12",
    "3.1.13",
    "3.1.13-rc1",
    "3.1.14",
    "3.1.14-rc1",
    "3.1.15",
    "3.1.16",
    "3.1.16-rc1",
    "3.1.17-rc1",
    "3.1.17-rc2",
    "3.1.2",
    "3.1.2-rc1",
    "3.1.3",
    "3.1.3-rc1",
    "3.1.3-rc2",
    "3.1.4",
    "3.1.4-rc1",
    "3.1.5",
    "3.1.5-rc1",
    "3.1.6",
    "3.1.6-rc1",
    "3.1.6-rc2",
    "3.1.6-rc3",
    "3.1.7",
    "3.1.7-rc1",
    "3.1.8",
    "3.1.9",
    "3.1.9-rc1"
  ]
}

silverstripe/framework Packagist

Ecosystem versions

From 3.2.0 before 3.2.2

Fixed in 3.2.2

6 explicitly affected versions

3.2.0, 3.2.1, 3.2.1-rc1, 3.2.1-rc2, 3.2.2-rc1, 3.2.2-rc2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.2.0"
        },
        {
          "fixed": "3.2.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.2.0",
    "3.2.1",
    "3.2.1-rc1",
    "3.2.1-rc2",
    "3.2.2-rc1",
    "3.2.2-rc2"
  ]
}

silverstripe/framework Packagist

Ecosystem versions

From 3.3.0-beta1 before 3.3.0

Fixed in 3.3.0

4 explicitly affected versions

3.3.0-beta1, 3.3.0-rc1, 3.3.0-rc2, 3.3.0-rc3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.3.0-beta1"
        },
        {
          "fixed": "3.3.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.3.0-beta1",
    "3.3.0-rc1",
    "3.3.0-rc2",
    "3.3.0-rc3"
  ]
}

Set up in your agent.

Investigate in your agent.

Silverstripe Missing security check on dev/build/defaults

The advisory, in context

Affected packages

References