CVE-2020-9309

Vulnerability

Silverstripe CMS versions up to 4.5 are susceptible to script execution from malicious upload contents under allowed file extensions, such as HTML code embedded in a TXT file. The root cause is that the system relies on file extension whitelisting rather than content validation; when files are stored as protected or draft files, the browser's MIME detection can cause the file to be interpreted as executable content, leading to script execution. [1]

Attack

Surface Uploads stored as protected or draft files are allowed by default for authorized users only, but the attack surface can be expanded through custom logic or modules like silverstripe/userforms, potentially enabling unauthenticated users to upload malicious files. The vulnerability is triggered when a user with access to the protected/draft file views it in a browser, which may execute embedded scripts due to MIME sniffing. [1]

Impact

An authenticated attacker who can upload files with allowed extensions (e.g., TXT) can inject HTML or JavaScript that will be executed in the context of the victim's browser when the file is accessed. This can lead to cross-site scripting, data theft, or further compromise of the CMS instance.

Mitigation

Sites using the silverstripe/mimevalidator module, which enforces MIME type whitelists instead of extension whitelists, are not affected. The Common Web Platform (CWP) includes this module by default. Users should upgrade to a patched version or enable the mimevalidator module to prevent this issue. [1]