CVE-2024-47605 Overview
CVE-2024-47605 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in silverstripe-asset-admin, the assets gallery module used for asset management in the Silverstripe CMS. The flaw resides in the "insert media" functionality, which processes oEmbed JSON responses from remote providers. When an oEmbed response includes an HTML attribute, that HTML replaces the embed shortcode without sanitization. An attacker who can influence the oEmbed response can inject a script payload that executes in both the CMS and the front-end of the website. The issue has been fixed in silverstripe/framework version 5.3.8.
Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any CMS administrator or site visitor who views affected content, enabling session theft, CMS actions on behalf of privileged users, and defacement.
Affected Products
- silverstripe/silverstripe-asset-admin (asset gallery module)
- silverstripe/framework prior to 5.3.8
- Silverstripe CMS installations that expose the "insert media" oEmbed workflow
Discovery Timeline
- 2025-01-14 - CVE-2024-47605 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47605
Vulnerability Analysis
The Silverstripe CMS "insert media" feature allows editors to embed remote content by URL. The CMS resolves the URL through the oEmbed protocol and receives a JSON document describing the media. Silverstripe stores an [embed] shortcode in the content and later expands that shortcode using data from the oEmbed response.
The vulnerability stems from unsanitized substitution of the oEmbed html attribute in place of the shortcode. Because the framework treats the provider-supplied HTML as trusted markup, any <script> tags or event-handler attributes contained in the response reach the rendered DOM verbatim. The payload runs in the security context of both the authenticated CMS editor and any unauthenticated visitor viewing the published page.
Exploitation requires user interaction to insert the malicious oEmbed URL, which aligns with the network attack vector and low complexity described in the advisory. Once inserted, the payload persists in stored content, giving the flaw stored-XSS characteristics rather than reflected behavior.
Root Cause
The root cause is missing output encoding of remote oEmbed html data before it replaces the shortcode. Silverstripe treated an external, attacker-influenced field as safe HTML. The fix in commit 09b5052c86932f273e0d733428c9aade70ff2a4a applies proper handling before the HTML reaches the CMS or front-end templates.
Attack Vector
An attacker hosts a URL that returns an oEmbed JSON response whose html field carries a script payload. A CMS editor pastes that URL into the "insert media" dialog. The shortcode is stored in the database and later expanded on page render, executing the injected JavaScript in every viewer's browser. See the GitHub Security Advisory for the vendor description of the exploitation path.
Detection Methods for CVE-2024-47605
Indicators of Compromise
- Stored [embed] shortcodes in the CMS database referencing oEmbed providers outside the organization's approved allowlist.
- Rendered pages containing inline <script> tags or on* event handlers originating from embedded media blocks.
- CMS audit log entries showing "insert media" actions immediately followed by page publish events from the same editor session.
Detection Strategies
- Scan the SiteTree and draft content tables for [embed ...] shortcodes whose source URLs do not match a trusted provider list.
- Add Content Security Policy (CSP) reporting to capture inline script violations on pages that render embedded media.
- Review web server access logs for unusual outbound calls from the CMS oEmbed resolver to attacker-controlled domains.
Monitoring Recommendations
- Alert on CMS content edits that introduce <script>, javascript:, or on*= fragments into published HTML fields.
- Monitor administrator accounts for anomalous session behavior after they view content containing recently inserted embeds.
- Track outbound HTTP requests from Silverstripe web nodes to identify oEmbed lookups against unfamiliar hosts.
How to Mitigate CVE-2024-47605
Immediate Actions Required
- Upgrade silverstripe/framework to version 5.3.8 or later across all environments.
- Audit existing content for [embed] shortcodes that resolve to untrusted oEmbed providers and remove or replace them.
- Rotate CMS session cookies and administrator credentials if evidence of exploitation is found.
Patch Information
Silverstripe published a fix in silverstripe/framework5.3.8. The corrective change is available in commit 09b5052c86932f273e0d733428c9aade70ff2a4a. Additional context is provided in the Silverstripe CVE-2024-47605 release notes.
Workarounds
- The vendor states there are no known workarounds; upgrading is required.
- As a compensating control, restrict the "insert media" permission to a minimal set of trusted editors until the upgrade is deployed.
- Deploy a strict Content Security Policy that blocks inline scripts on both CMS and public-facing pages to reduce payload execution.
# Update Silverstripe framework to the patched release using Composer
composer require silverstripe/framework:^5.3.8
composer update silverstripe/framework silverstripe/asset-admin
vendor/bin/sake dev/build flush=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
