Silverstripe XSS in shortcodes
Date: 2022-11
Affected: composer/silverstripe/framework, composer/silverstripe/assets
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2020-25817
CVE-2021-41559
CVE-2022-25238
CVE-2022-38724
CWE: CWE-611
CWE-776
CWE-79
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk.


Mitigations:

Architectural layers (MAESTRO):