CVE-2019-12149
📋 TL;DR
This CVE describes a SQL injection vulnerability in SilverStripe's restfulserver and registry modules that allows attackers to execute arbitrary SQL commands. Attackers can potentially read, modify, or delete database content, and in some cases achieve remote code execution. Organizations using affected versions of these SilverStripe modules are vulnerable.
💻 Affected Systems
- silverstripe/restfulserver
- silverstripe/registry
📦 What is this software?
Registry by Silverstripe
Registry by Silverstripe
Restfulserver by Silverstripe
Restfulserver by Silverstripe
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions in place.
🎯 Exploit Status
SQL injection vulnerabilities are well-understood and often have automated exploitation tools available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: restfulserver: 1.0.9, 2.0.4, 2.1.2; registry: 2.1.1, 2.2.1
Vendor Advisory: https://www.silverstripe.org/download/security-releases/cve-2019-12149
Restart Required: No
Instructions:
1. Update composer.json to require patched versions. 2. Run 'composer update silverstripe/restfulserver' or 'composer update silverstripe/registry'. 3. Clear SilverStripe cache if needed.
🔧 Temporary Workarounds
Disable vulnerable modules
allTemporarily disable the restfulserver and registry modules if not essential
Remove module references from composer.json and run composer update
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in custom code
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check composer.json for affected module versions: 'composer show silverstripe/restfulserver' and 'composer show silverstripe/registry'Check Version:
composer show silverstripe/restfulserver silverstripe/registry | grep -E 'name|versions'Verify Fix Applied:
Verify installed versions are patched: 'composer show silverstripe/restfulserver | grep versions' and 'composer show silverstripe/registry | grep versions'📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts or parameter manipulation in web logs
- Unexpected database schema changes
Network Indicators:
- SQL keywords in HTTP parameters (SELECT, UNION, INSERT, etc.)
- Unusual database connection patterns from web servers
SIEM Query:
web_logs WHERE (url CONTAINS 'SELECT' OR url CONTAINS 'UNION' OR url CONTAINS 'INSERT') AND status_code = 200