CVE-2024-29885

Executive Summary

CVE-2024-29885 is a missing authorization vulnerability in the Silverstripe Reports module (silverstripe/reports). The flaw allows any authenticated user with access to the reports admin section to bypass the canView() method and access any report directly via its URL. This means a user who should be restricted from viewing a specific report can still retrieve its data by navigating to the report's direct URL. The vulnerability has a CVSS score of 4.3 (Medium) and affects versions prior to 5.2.3. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating a very low likelihood of exploitation in the wild. The vendor has released a fix in version 5.2.3, and there are no known workarounds.

Supply Chain & Package Security

This vulnerability affects the silverstripe/reports package, which is a core component of the Silverstripe CMS framework. It is distributed via Composer (Packagist). Organizations using Silverstripe should verify their dependency version and update to 5.2.3 or later to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid user account with access to the reports admin section.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited disclosure of report data.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires authentication but allows unauthorized access to sensitive report data. The low EPSS score suggests limited active exploitation, but the risk increases if sensitive reports are exposed.

Deep Dive & Mechanics

The vulnerability lies in the authorization logic of the Silverstripe Reports module. The canView() method is intended to restrict access to specific reports based on user permissions. However, the check is only enforced when the report is rendered within the admin interface (e.g., via the reports list). When a user directly accesses a report's URL (e.g., /admin/reports/show/ReportName), the canView() check is bypassed, and the report is served regardless of the user's permissions.

The root cause is that the controller action that handles direct report access does not invoke the canView() method before rendering the report. This allows any authenticated user with access to the reports admin section to view any report, even if they are explicitly denied by the report's canView() implementation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-5.2.3):

// In ReportAdmin.php or similar controller
public function show($request) {
    $report = $this->getReport($request->param('ID'));
    // Missing canView() check
    return $this->render($report);
}

Patched Code (5.2.3+):

// In ReportAdmin.php or similar controller
public function show($request) {
    $report = $this->getReport($request->param('ID'));
    if (!$report->canView()) {
        return $this->httpError(403, 'You do not have permission to view this report.');
    }
    return $this->render($report);
}

The fix adds a canView() check before rendering the report, ensuring that the authorization logic is enforced for direct URL access.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account with access to the Silverstripe admin reports section.
• Knowledge of the report's direct URL (e.g., /admin/reports/show/MySensitiveReport).

Exploitation Steps:

1. Log in to the Silverstripe admin panel.
2. Navigate to the reports section to confirm access.
3. Identify a report that the user should not be able to view (e.g., a report with canView() returning false for this user).
4. Directly access the report's URL: https://target.com/admin/reports/show/MySensitiveReport.
5. The report data is displayed, bypassing the intended restriction.

No public exploit code is available.

Blue Team (Detection & Hardening)

Detection:

• Monitor access logs for direct requests to /admin/reports/show/* from users who do not have explicit permission for those reports.
• Look for anomalous patterns where a user accesses a report URL without first visiting the reports list page.

Hardening:

• Immediately upgrade to Silverstripe 5.2.3 or later.
• If upgrade is not possible, restrict access to the reports admin section using web server rules (e.g., IP whitelisting) as a temporary measure.
• Review and audit user permissions for the reports module.

Indicators of Compromise (IOCs)

• URL Pattern: /admin/reports/show/* accessed by users with restricted permissions.
• Log Entries: HTTP 200 responses to /admin/reports/show/* for users who should receive a 403.
• User Activity: Users accessing report URLs without corresponding navigation to the reports list.

Detection Engineering

YARA Rule

rule CVE_2024_29885_Silverstripe_Reports_Bypass {
    meta:
        description = "Detects potential exploitation of CVE-2024-29885 by identifying direct access to Silverstripe report URLs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29885"
    strings:
        $url_pattern = "/admin/reports/show/"
    condition:
        $url_pattern
}

Sigma Rule

title: Silverstripe Reports Direct URL Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects direct access to Silverstripe report URLs which may indicate exploitation of CVE-2024-29885
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem|contains: "/admin/reports/show/"
    condition: selection
falsepositives:
    - Legitimate admin users accessing reports
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29885 Silverstripe Reports Direct URL Access"; flow:to_server,established; content:"/admin/reports/show/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Action:

• Upgrade to Silverstripe 5.2.3 or later. This is the only official fix.

Mitigation (if upgrade is not possible):

• Implement web server access controls to restrict /admin/reports/show/* to only authorized IP addresses.
• Monitor logs for suspicious access patterns.
• Review and tighten user permissions for the reports module.

Long-term:

• Ensure all custom reports implement proper canView() checks.
• Regularly update Silverstripe and its dependencies.

Valters IT
DevSecOps & Cyber Threat Intelligence