CVE-2020-9311

Vulnerability

Overview The vulnerability resides in SilverStripe CMS versions up to 4.5, where insufficient sanitization of user profile data allows stored cross-site scripting (XSS). Authenticated users with CMS access can inject malicious JavaScript code into their profile fields [1]. This injected content is subsequently included in login form URLs generated by the application.

Exploitation

Method An attacker must have a valid CMS account to craft a malicious profile. They then create a specially crafted login URL containing the XSS payload. When other users (e.g., site administrators or regular users) visit this URL, the payload executes in their browser. The attack requires no special privileges beyond a standard CMS login, but successful exploitation depends on tricking victims into clicking the crafted link.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the victim's session context. This can result in session hijacking, data exfiltration, unauthorized actions, or defacement of the CMS interface. The XSS targets users who interact with the login form, making it a cross-user attack vector.

Mitigation

The issue is fixed in SilverStripe versions later than 4.5 [3]. Users are advised to upgrade to a patched release. No workaround is available for unpatched versions, so immediate updating is recommended to mitigate the risk.