PT-2023-21229 · Hasura · Hasura Graphql Engine

40826D · Publicado 2023-03-14 · Atualizado 2023-03-21 · CVE-2023-27588

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hasura GraphQL Engine versions prior to 1.3.4 Hasura GraphQL Engine versions prior to 2.55.1 Hasura GraphQL Engine versions prior to 2.20.1 Hasura GraphQL Engine versions prior to 2.21.0-beta1

Description A path traversal vulnerability has been discovered within Hasura GraphQL Engine. The vulnerability affects self-hosted Hasura projects with publicly exposed deployments that are not protected by a WAF or other HTTP protection layer. Projects running on Hasura Cloud are not vulnerable.

Recommendations For versions prior to 1.3.4, upgrade to version 1.3.4 to receive a patch. For versions prior to 2.55.1, upgrade to version 2.55.1 to receive a patch. For versions prior to 2.20.1, upgrade to version 2.20.1 to receive a patch. For versions prior to 2.21.0-beta1, upgrade to version 2.21.0-beta1 to receive a patch.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-27

CWE-22

Identificadores relacionados

CVE-2023-27588

GHSA-C9RW-RW2F-MJ4X

Produtos afetados

Hasura Graphql Engine

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27588.json · Exploit
• https://github.com/hasura/graphql-engine/releases/tag/v2.20.1 · Nota
• https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x · Aviso do Fabricante
• https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158 · Correção
• https://github.com/hasura/graphql-engine/releases/tag/v2.11.5 · Nota
• https://github.com/hasura/graphql-engine/releases/tag/v1.3.4 · Nota
• https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1 · Nota
• https://t.me/cibsecurity/60024 · Publicação no Telegram
• https://t.me/pentestingnews/34100 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27588 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27588 · Nota de Segurança