CVE-2022-25238

Vulnerability

Details

CVE-2022-25238 is a stored cross-site scripting (XSS) vulnerability in Silverstripe Framework versions up to and including 4.10.0. The root cause is insufficient server-side sanitization of script tags that can be added to website content via XMLHttpRequest (XHR). The vulnerability is exploitable only when the cwp-core module is not installed or the sanitise_server_side configuration option is not set to true in the project code [2][3].

Exploitation

An authenticated CMS user can craft a malicious XHR request to inject arbitrary script tags into website content. No special privileges beyond standard CMS access are required, but the attacker must be authenticated. The attack bypasses server-side sanitization due to the missing or disabled protection mechanisms [2][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of any user viewing the affected page. This can lead to session hijacking, data theft, defacement, or other client-side attacks [2][3].

Mitigation

Silverstripe has addressed this vulnerability in later releases. Users should upgrade to a patched version of silverstripe/framework. As a workaround, ensure the cwp-core module is installed and that sanitise_server_side is set to true in the project configuration [2][3].