CVE-2019-19325 XSS through non-scalar FormField attributes
- Severity:
- High (?)
- Identifier:
- CVE-2019-19325
- Versions Affected:
- silverstripe/framework:^4.3.0
- Versions Fixed:
- silverstripe/framework:4.4.5, silverstripe/framework:4.5.2
- Release Date:
- 2020-02-17
Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input. There is no known attack vector for extracting user-session information or credentials automatically, it required a user to fall for the phishing attempt. XSS can also be used to modify the presentation of content in malicious ways.
The vulnerability is known to apply in at least the following cases:
- The login form provided by Silverstripe. When the login form is used with Multi Factor Authentication (MFA), the attack complexity for phishing increases, and is mitigated by using security keys such as Yubikey as an unphishable token.
- Forms which are configured to populate field values based on request parameters. This usually happens via setting the
$valueon a FormField instance during construction of the form, or by loading request data viaForm->loadDataFrom($myRequest->getVars()). - Forms which have form validation applied through
RequiredFields, and opt-out of using CSRF tokens viadisableSecurityToken(). In this case, the vulnerability is more impactful if the form is also configured to accept GET submissions, rather than the default of POST submissions.
The vulnerability has not identified on forms created through the silverstripe/userforms module.
Base CVSS: 7.5
Reported by: Ed Chipman, Senior Solutions Architect, Webbuilders Group
