SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
Moderate severity
GitHub Reviewed
Published
May 23, 2024
to the GitHub Advisory Database
Package
Affected versions
>= 3.0.0, <= 3.0.13
>= 3.1.0, < 3.1.13
Patched versions
3.0.14
3.1.13
Description
Published to the GitHub Advisory Database
May 23, 2024
Reviewed
May 23, 2024
When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.
For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service.
The fix in this case is to ensure that empty tokens fail the validation check.
References