CMS Security Testing

SilverStripe Security Testing: Default Credentials, API Key, Database, and CMS

📅 July 3, 2026 ⏱ 10 min read 🏷 SilverStripe, CMS, .env, SS_DATABASE_PASSWORD, SS_DEFAULT_ADMIN_PASSWORD, SS_SECRET_KEY, Member Table, GraphQL, /dev/build, AccessToken, bcrypt, Developer Mode

SilverStripe is a popular open-source PHP CMS and web application framework used widely across Australia, New Zealand, and the UK. Key assessment areas: the .env file exposes SS_DATABASE_PASSWORD and the default admin password SS_DEFAULT_ADMIN_PASSWORD in plaintext; developer mode exposes /dev/build, /dev/tasks, and /dev/state endpoints; the GraphQL API at /graphql may return unauthenticated data; and the Member table stores bcrypt password hashes. This guide covers systematic SilverStripe security assessment.

.env SS_DATABASE_PASSWORD and Admin Credential Extraction
Developer Mode and GraphQL API Assessment
MySQL Member Hash and AccessToken Extraction
SilverStripe Security Hardening

.env SS_DATABASE_PASSWORD and Admin Credential Extraction

# SilverStripe — .env credential extraction
SS_URL="https://cms.example.com"

# SilverStripe .env — database and admin credentials
cat /var/www/silverstripe/.env 2>/dev/null
# SS_DATABASE_CLASS="MySQLDatabase"
# SS_DATABASE_NAME="silverstripe"
# SS_DATABASE_USERNAME="silverstripe"
# SS_DATABASE_PASSWORD="..."           <-- MySQL database password
# SS_DATABASE_SERVER="localhost"
# SS_DEFAULT_ADMIN_USERNAME="admin"
# SS_DEFAULT_ADMIN_PASSWORD="..."      <-- Default admin user password (CRITICAL)
# SS_SECRET_KEY="..."                  <-- Session signing secret / CSRF key

python3 -c "
import re
content = open('/var/www/silverstripe/.env').read()
patterns = {
    'db_password': r'SS_DATABASE_PASSWORD=[\"\\x27]?([^\"\\x27\\n]+)',
    'db_username': r'SS_DATABASE_USERNAME=[\"\\x27]?([^\"\\x27\\n]+)',
    'db_name': r'SS_DATABASE_NAME=[\"\\x27]?([^\"\\x27\\n]+)',
    'admin_user': r'SS_DEFAULT_ADMIN_USERNAME=[\"\\x27]?([^\"\\x27\\n]+)',
    'admin_pass': r'SS_DEFAULT_ADMIN_PASSWORD=[\"\\x27]?([^\"\\x27\\n]+)',
    'secret_key': r'SS_SECRET_KEY=[\"\\x27]?([^\"\\x27\\n]+)',
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m: print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Test .env web exposure (CRITICAL misconfiguration)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${SS_URL}/.env" 2>/dev/null)
echo ".env HTTP: ${STATUS}"
# Should return 403 — if 200, plaintext credentials exposed

# Test admin login with extracted credentials
ADMIN_PASS="extracted-password"
curl -s -X POST "${SS_URL}/Security/LoginForm" \
  -d "Email=admin&Password=${ADMIN_PASS}&action_doLogin=1&SecurityID=extracted" \
  -c /tmp/ss_c -b /tmp/ss_c -L 2>/dev/null | grep -o "CMSMain\|Admin" | head -1

Developer Mode and GraphQL API Assessment

# SilverStripe — developer mode and GraphQL API assessment
SS_URL="https://cms.example.com"

# Developer mode endpoints (should require admin or be disabled in production)
for ENDPOINT in "/dev/build" "/dev/tasks" "/dev/state" "/dev/viewcode"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${SS_URL}${ENDPOINT}" 2>/dev/null)
  echo "${ENDPOINT}: HTTP ${STATUS}"
done
# /dev/build in production = database schema rebuild without auth (dangerous)
# /dev/state may leak application state and config values

# SilverStripe GraphQL API assessment
# Default GraphQL endpoint at /graphql
curl -s -X POST "${SS_URL}/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{queryType{name}}}"}' 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    schema = d.get('data',{}).get('__schema',{})
    print(f'GraphQL available: {bool(schema)}')
    print(f'Query type: {schema.get(\"queryType\",{}).get(\"name\")}')
except: pass
" 2>/dev/null

# Introspect available queries
curl -s -X POST "${SS_URL}/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name fields{name}}}}"}' 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    types=d.get('data',{}).get('__schema',{}).get('types',[])
    for t in types:
        if not t['name'].startswith('__') and t.get('fields'):
            print(f'Type {t[\"name\"]}: {[f[\"name\"] for f in t[\"fields\"][:5]]}')
except: pass
" 2>/dev/null

MySQL Member Hash and AccessToken Extraction

# SilverStripe MySQL database — Member hash and AccessToken extraction
DB_PASS="extracted-db-password"

mysql -u silverstripe -p"${DB_PASS}" silverstripe 2>/dev/null << 'EOF'
-- SilverStripe Member table — all CMS users with password hashes
SELECT m.ID, m.Email, m.Password,
       m.FirstName, m.Surname,
       m.PasswordEncryption,    -- 'blowfish' (bcrypt), 'sha1', 'md5'
       m.LockedOutUntil,
       m.FailedLoginCount,
       m.LastVisited
FROM Member m
ORDER BY m.ID
LIMIT 20;
-- Password field: includes algorithm prefix e.g. $2y$10$...

-- Group membership (identify admins)
SELECT m.Email, m.FirstName, m.Surname,
       g.Title as group_name, g.Code as group_code
FROM Member m
JOIN Group_Members gm ON gm.MemberID = m.ID
JOIN Group g ON g.ID = gm.GroupID
WHERE g.Code IN ('administrators', 'admin', 'cms-admin')
ORDER BY m.ID;

-- AccessToken table (API Bearer tokens)
SELECT at.ID, at.Token, at.ExpiresAt, at.Compact,
       m.Email, m.FirstName, m.Surname
FROM AccessToken at
JOIN Member m ON m.ID = at.MemberID
WHERE at.ExpiresAt IS NULL OR at.ExpiresAt > NOW()
ORDER BY at.ID DESC
LIMIT 20;
-- Token: plaintext Bearer token for API authentication

-- LoginAttempt log (recent access patterns)
SELECT la.Email, la.IP, la.Status, la.Created
FROM LoginAttempt la
ORDER BY la.Created DESC
LIMIT 20;
EOF

SilverStripe Security Hardening

SilverStripe Security Hardening Checklist:

Never expose the .env file via the web server — SilverStripe's .env file in the project root contains the most sensitive credentials including SS_DATABASE_PASSWORD (MySQL), SS_DEFAULT_ADMIN_PASSWORD (the default admin user password used before any CMS users are created), and SS_SECRET_KEY (used for CSRF token generation, session signing, and API key derivation); the .env file must not be served by the web server; SilverStripe's recommended webroot is the public/ subdirectory — the .env file stays in the project root above the webroot and is inherently protected; if the .env is placed inside the webroot, add explicit deny rules in nginx/Apache; verify by attempting to fetch /.env and confirm it returns 403 or 404
Remove SS_DEFAULT_ADMIN_PASSWORD from .env in production — the SS_DEFAULT_ADMIN_PASSWORD in .env creates a built-in admin account outside the CMS Member system; this account cannot be audited, managed, or have 2FA enabled via the CMS; remove this variable from .env and create a proper CMS Member admin user instead; the default admin account is a common attack target as it always exists if the variable is set, regardless of whether CMS Member admins have been created; if you must retain it temporarily, use a strong random password that is different from any CMS Member password
Disable developer mode and /dev/* endpoints in production — SilverStripe's SS_ENVIRONMENT_TYPE="dev" mode enables powerful debugging endpoints; /dev/build rebuilds the database schema and can reset data; /dev/tasks lists and executes registered BuildTasks; /dev/viewcode exposes application source code; set SS_ENVIRONMENT_TYPE="live" in .env for all production deployments; in live mode, /dev/* endpoints require admin CMS login; verify this by accessing /dev/build without authentication — it should redirect to /Security/login; never expose /dev/state as it may output SS_SECRET_KEY and environment variable values
Secure the GraphQL API with proper permission checks — SilverStripe 4+ includes a GraphQL API at /graphql; by default, some query types may be accessible without authentication depending on DataObject canView() permissions; audit all GraphQL types and their permission requirements using the SilverStripe GraphQL introspection endpoint; implement explicit canView(), canEdit(), canCreate(), and canDelete() permission checks on all DataObjects; use the graphql-devtools extension only in development; configure query depth limits and complexity limits to prevent expensive introspection attacks; consider restricting the /graphql endpoint to authenticated users at the web server level if anonymous access is not required
Audit and rotate AccessToken Bearer tokens — SilverStripe's AccessToken table stores API Bearer tokens; tokens without an ExpiresAt date persist indefinitely; audit all tokens in the AccessToken table and rotate or revoke tokens that are unused or associated with inactive members; implement token expiry for all new API tokens; SilverStripe's BCrypt password hashing (PasswordEncryption='blowfish') is secure for current Member passwords, but any SHA-1 or MD5 password hashes from older versions indicate accounts that predate the secure hashing migration — identify these members (PasswordEncryption != 'blowfish') and force password resets

Security Test	Method	Risk
.env SS_DATABASE_PASSWORD and SS_DEFAULT_ADMIN_PASSWORD extraction	Read /var/www/silverstripe/.env — MySQL database credentials plus plaintext default admin password enabling immediate CMS admin access	Critical
/.env web exposure test	GET /.env — if HTTP 200, all credentials including SS_SECRET_KEY for CSRF/session forgery are publicly accessible	Critical
/dev/build unauthenticated database rebuild	GET /dev/build — if SS_ENVIRONMENT_TYPE=dev in production, unauthenticated database schema rebuild; can alter/reset table structures	High
Member table bcrypt/MD5 password hash extraction	MySQL SELECT Password, PasswordEncryption FROM Member — bcrypt hashes for current users; legacy MD5 hashes for older accounts (trivially crackable)	High
AccessToken plaintext Bearer token extraction	MySQL SELECT Token FROM AccessToken — plaintext Bearer tokens for API authentication at member permission level	High

Automate SilverStripe Security Testing

Ironimo tests SilverStripe deployments for /.env SS_DATABASE_PASSWORD and SS_DEFAULT_ADMIN_PASSWORD web exposure, SS_SECRET_KEY CSRF/session key extraction, SS_ENVIRONMENT_TYPE dev/live mode detection, /dev/build unauthenticated access assessment, /dev/tasks and /dev/state endpoint exposure, GraphQL /graphql introspection and unauthenticated data access, Member table bcrypt and legacy MD5 hash extraction, AccessToken plaintext Bearer token enumeration, Group_Members administrator identification, and SilverStripe version disclosure for CVE targeting.

Start free scan

Table of Contents

.env SS_DATABASE_PASSWORD and Admin Credential Extraction

Developer Mode and GraphQL API Assessment

MySQL Member Hash and AccessToken Extraction

SilverStripe Security Hardening

Automate SilverStripe Security Testing