silverstripe/framework BackURL validation bypass with malformed URLs

A carefully constructed malformed URL can be used to circumvent the offsite redirection protection used on BackURL parameters. This could lead to users entering sensitive data in malicious websites instead of the intended one.

Published: May 27, 2024
Updated: Jun 27, 2024
GHSA: GHSA-m5q3-mvcr-gc5m
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWEs:

CWE-601

Affected Software
References

Software	From	Fixed in
silverstripe / framework	4.0.0-rc1	4.0.4
silverstripe / framework	4.1.0-rc1	4.1.1

https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-008-1.yaml
https://github.com/silverstripe/silverstripe-framework/commit/9053014a7e2eba28d000881e0bb3cc1d6e6b2eea
https://www.silverstripe.org/download/security-releases/ss-2018-008

Vulnerability Database

silverstripe/framework BackURL validation bypass with malformed URLs