PT-2023-21229 · Hasura · Hasura Graphql Engine

40826D · Published 2023-03-14 · Updated 2023-03-21 · CVE-2023-27588

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hasura GraphQL Engine versions prior to 1.3.4 Hasura GraphQL Engine versions prior to 2.55.1 Hasura GraphQL Engine versions prior to 2.20.1 Hasura GraphQL Engine versions prior to 2.21.0-beta1

Description A path traversal vulnerability has been discovered within Hasura GraphQL Engine. The vulnerability affects self-hosted Hasura projects with publicly exposed deployments that are not protected by a WAF or other HTTP protection layer. Projects running on Hasura Cloud are not vulnerable.

Recommendations For versions prior to 1.3.4, upgrade to version 1.3.4 to receive a patch. For versions prior to 2.55.1, upgrade to version 2.55.1 to receive a patch. For versions prior to 2.20.1, upgrade to version 2.20.1 to receive a patch. For versions prior to 2.21.0-beta1, upgrade to version 2.21.0-beta1 to receive a patch.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-27

CWE-22

Related Identifiers

CVE-2023-27588

GHSA-C9RW-RW2F-MJ4X

Affected Products

Hasura Graphql Engine

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27588.json · Exploit
• https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x · Vendor Advisory
• https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158 · Patch
• https://osv.dev/vulnerability/CVE-2023-27588 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27588 · Security Note
• https://github.com/hasura/graphql-engine/releases/tag/v2.20.1 · Note
• https://github.com/hasura/graphql-engine/releases/tag/v2.11.5 · Note
• https://github.com/hasura/graphql-engine/releases/tag/v1.3.4 · Note
• https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1 · Note
• https://t.me/cibsecurity/60024 · Telegram Post
• https://t.me/pentestingnews/34100 · Telegram Post