Silverpeas Core is an open-source digital workplace platform designed to facilitate collaboration and communication within organizations. Silverpeas Core includes the essential features and functionalities that serve as the backbone for the application – including user management, authentication, access control, content management, and messaging functionality. It can be installed on either Windows or Linux, but our research was exclusively on the Linux application. 

The official docker image has over one million downloads and is actively used by government, industrial, and community organizations.

A primary focus of Silverpeas is enabling collaboration between internal and external teams. To facilitate this, a messaging feature is included in the application. Silverpeas makes it convenient for any user to send a message to the administrators by including a “Write to administrators” option on the user’s personal workspace after logging into the application.

While testing this functionality, we discovered Silverpeas checks for Cross-Site Scripting by filtering out <script> tags in messages. This check can be bypassed by performing XSS without using <script> tags. We first confirmed this by sending a basic “alert” when the message was view by the administrator:

When this message was viewed by the administrator, the Javascript was successfully executed in their browser.

Although generating an alert demonstrates XSS, we wanted to weaponize the vulnerability to show how it could be used by an adversary. By analyzing the administrative request to elevate permissions, we discovered the following payload will successfully execute Javascript that elevates the adversary’s permissions: 

There are three pieces of information related to our own user we need for a viable attack: 

1. The ID of our user. 
2. The last name of our user. 
3. The X-STKN of our user (the X-STKN is the Silverpeas Core CSRF token). 

We would already know the last name of our user and the other information can be retrieved by sending a message to ourselves and intercepting the POST request with Burp Suite: 

With this information and the previous payload, an adversary can send a message to the administrators with the Javascript in the “content” field of the request. As soon as the malicious message is viewed by an administrator, the adversary will gain full administrative rights to the application. 

Now that we have administrative access to the application, we can abuse a feature called “Silvercrawler.” Silvercrawl allows administrators to host files for other users to access. The Silvercrawler runs as the “root” user on the backend Linux server, so it can view sensitive files such as /etc/shadow.

Once Silvercrawler is enabled, we can specify the Root directory. To perform a full file read and enumerate the entire system, we can set the root directory as “/”. After this is configured, we can click the “Ok” button to save the application.

By navigating to the new path we created, we now have full access to the underlying file system. From here an adversary can search for credentials, read environmental variables, or access configuration files.