PT-2023-19128 · WordPress · Wpgraphql

Ravi Dharmawan · Published 2023-06-30 · Updated 2023-12-20 · CVE-2023-23684

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 1.14.5 and earlier

Description A Server-Side Request Forgery (SSRF) issue affects WPGraphQL, allowing authenticated users with media upload capabilities to execute the createMediaItem mutation and potentially gain unwarranted access to the server by passing executable paths in the filePath argument.

Recommendations For WPGraphQL versions 1.14.5 and earlier, update to WPGraphQL v1.14.6 or newer to resolve the issue. If updating to v1.14.6 or higher is not possible, add a filter to the graphql pre resolve field function in functions.php to override the vulnerable createMediaItem mutation resolver, ensuring that only allowed protocols (https, http, file) are used and the file type is validated.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-23684

GHSA-CFH4-7WQ9-6PGG

Affected Products

Wpgraphql

References · 9

• https://osv.dev/vulnerability/GHSA-cfh4-7wq9-6pgg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23684 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23684 · Vendor Advisory
• https://github.com/wp-graphql/wp-graphql/pull/2840 · Note
• https://github.com/wp-graphql/wp-graphql/releases/tag/v1.14.6 · Note
• https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-cfh4-7wq9-6pgg · Note
• https://github.com/wp-graphql/wp-graphql · Note
• https://t.me/cvenotify/60621 · Telegram Post
• https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve · Note