Skip to content
OpenAdvisories
Medium · 5.4 Public exploit CVE-2024-47605 EUVD-2025-0081GHSA-7cmp-cgg8-4c82

Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin

Published Jan 14, 2025 · Updated Jan 15, 2025 · Assigned by GitHub_M

Vendor: silverstripe Product: silverstripe-asset-admin Package: silverstripe/framework Ecosystem: Packagist

Description

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

VendorProductAffectedFixed
silverstripe silverstripe-asset-admin < 5.3.8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist silverstripe/framework < 5.3.8 5.3.8 GHSA-7cmp-cgg8-4c82

References