Silverstripe Missing CSRF protection in login form
LoginForm calls disableSecurityToken(), which causes a "shared host domain" vulnerability: http://stackoverflow.com/a/15350123.
| Software | From | Fixed in |
|---|---|---|
silverstripe / framework
|
3.1.18 | 3.1.19 |
|
silverstripe / framework
|
3.2.3 | 3.2.4 |
|
silverstripe / framework
|
3.3.1 | 3.3.2 |
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-006-1.yaml
- https://github.com/silverstripe/silverstripe-framework/commit/a6bd22ab2f3b11a054d20be13306a19089510989
- https://stackoverflow.com/questions/6412813/do-login-forms-need-tokens-against-csrf-attacks/15350123#15350123
- https://www.silverstripe.org/download/security-releases/ss-2016-006
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime