CVE-2020-25817

Vulnerability

SilverStripe through version 4.6.0-rc1 contains an XML External Entity (XXE) vulnerability in the CSSContentParser class [1][2]. This developer utility was intended to parse HTML within unit tests, but when it is misused in custom project code that processes external or user-submitted data, the XML parser will expand external entities, leading to information disclosure or other attacks [2].

Exploitation

An attacker must be able to supply crafted XML or HTML input that is passed to the CSSContentParser by custom project code that misuses this utility [2]. No special network position is required beyond the ability to submit data to the vulnerable endpoint. The parser processes the input and, because external entities are not disabled by default, it will fetch the external resource referenced in the entity [2].

Impact

Successful exploitation can lead to XML External Entity (XXE) attacks, which may result in local file disclosure or server-side request forgery (SSRF) [2]. Additionally, when the parser output is rendered back as HTML, the attacker can inject malicious scripts, leading to cross-site scripting (XSS) in the context of the target application [2].

Mitigation

The vulnerability is mitigated in SilverStripe by disabling external entities during parsing [2]. The fix was implemented in the underlying framework; details on the specific patched version are expected in the SilverStripe release announcements [1]. Users should ensure they are running the latest patched release and avoid passing untrusted data to CSSContentParser in custom code.