User Impersonation Affecting silverstripe/framework package, versions >=3.1.0, <3.1.17-rc2>=3.2.0, <3.2.2-rc2>=3.3.0-beta1, <3.3.0-rc3

silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS.

Affected versions of this package are vulnerable to User Impersonation via insufficient validation of proxy-related HTTP headers. An attacker can spoof client IP addresses, hostnames, or protocols by supplying crafted forwarding headers that are trusted when requests pass through a reverse proxy. Because SilverStripe accepts multiple proxy header variants and relies on proxies to remove untrusted headers, spoofed values may bypass SSL enforcement, defeat IP-based restrictions, or circumvent hostname-specific access controls.

Note:

1. This issue primarily affects deployments behind reverse proxies that do not explicitly remove untrusted forwarding headers.

2. Deployments not using a reverse proxy may already be protected by Apache with mod_env enabled and SetEnv BlockUntrustedIPs true.

• GitHub Commit
• GitHub Commit
• GitHub Commit