CVE-2022-37429

Vulnerability

CVE-2022-37429 is an XSS vulnerability in Silverstripe silverstripe/framework up to version 4.11. The root cause is inadequate sanitization of the href attribute when it contains a javascript: URL with whitespace characters, allowing the URL scheme to be split and bypassing filters [2][3].

Exploitation

An attacker can craft a malicious link such as click where a space splits the javascript scheme. When a user clicks the link, the browser executes the JavaScript payload. No authentication is required if the link is reflected or stored in a vulnerable context [2].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the victim's browser, potentially resulting in session hijacking, data theft, or further attacks.

Mitigation

Silverstripe has provided patches in subsequent releases. Users are advised to upgrade to a version beyond 4.11. The Silverstripe forum [1] and the FriendsOfPHP security advisory [3] provide details on fixed versions.