Summary
SilverStripe Framework is vulnerable to Business Logic Errors in the Failed login count since that value can be a negative number.
Product
silverstripe/silverstripe-framework prior to 4.10.1.
Impact
Security weaknesses in business logic can allow a user to perform something that the business does not allow, which can be damaging to a whole application.
Since they usually entail acceptable use of the application’s functionality, they might be difficult to detect automatically.
Steps to reproduce
- After login, go to Security page under the path /admin/security/
- Click on any member record
- In the member edit form, enter a negative number at Failed login count field then click on Save button.
Expected result:
You will see that the member record has been edited successfully with the negative value in the Failed login count field. This is not true logic because it must be non-negative ( >=0 ).
Remediation
Update silverstripe/silverstripe-framework to version 4.10.1.
Credit
This issue was reported by @khanhchauminh through huntr.dev.
