CVE-2023-47320
📋 TL;DR
Silverpeas Core 6.3.1 and earlier versions have an incorrect access control vulnerability that allows low-privileged users to execute administrator-only functions. Specifically, attackers can put the application into maintenance mode, making it unavailable to all users. This affects all deployments running vulnerable versions of Silverpeas Core.
💻 Affected Systems
- Silverpeas Core
📦 What is this software?
Silverpeas by Silverpeas
⚠️ Risk & Real-World Impact
Worst Case
Application becomes completely unavailable to all legitimate users, causing service disruption and potential business impact.
Likely Case
Low-privileged users or attackers cause service disruption by enabling maintenance mode, leading to temporary unavailability.
If Mitigated
Proper access controls prevent unauthorized users from accessing administrative functions, maintaining normal operations.
🎯 Exploit Status
Exploitation requires low-privileged user credentials. Public proof-of-concept available from RhinoSecurityLabs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.2 or later
Vendor Advisory: http://silverpeas.com
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Download and install Silverpeas Core 6.3.2 or later. 3. Restart the Silverpeas application server. 4. Verify normal operation.
🔧 Temporary Workarounds
Temporary Access Restriction
allTemporarily restrict low-privileged user access to administrative endpoints
# Configure web server (e.g., Apache/Nginx) to block access to /silverpeas/admin/maintenance endpoints for non-admin users
🧯 If You Can't Patch
- Implement network segmentation to restrict access to Silverpeas administrative interfaces
- Monitor and alert on maintenance mode activation events in application logs
🔍 How to Verify
Check if Vulnerable:
Check Silverpeas version via web interface or configuration files. Versions 6.3.1 and below are vulnerable.Check Version:
Check silverpeas-version.properties file or web interface About pageVerify Fix Applied:
After patching, verify version is 6.3.2 or later. Test that low-privileged users cannot access maintenance mode functions.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /silverpeas/admin/maintenance endpoints
- Maintenance mode activation by non-admin users
Network Indicators:
- HTTP POST requests to maintenance endpoints from non-admin IPs
SIEM Query:
source="silverpeas.log" AND "maintenance mode" AND user!="admin"