PT-2023-21562 · Silverstripe · Silverstripe/Graphql

Guysartorelli · Published 2023-03-16 · Updated 2023-03-22 · CVE-2023-28104

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions silverstripe/graphql versions 4.1.1 through 4.2.2

Description The issue allows an attacker to execute a denial of service attack against a website with a publicly exposed GraphQL endpoint using a specially crafted GraphQL query. This mostly affects websites with particularly large or complex GraphQL schemas. If the Silverstripe CMS project does not expose a public-facing GraphQL schema, a user account is required to trigger the attack. Hosting the site behind a content delivery network (CDN) may further mitigate the risk.

Recommendations For versions 4.1.1 and 4.2.2, upgrade to silverstripe/graphql 4.1.2 or 4.2.3 to remedy the vulnerability. As a temporary workaround, consider restricting access to the publicly exposed GraphQL endpoint until the issue is resolved. If the site is hosted behind a CDN, ensure the CDN configuration is up-to-date to maximize the mitigation of the risk.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-28104

GHSA-67G8-C724-8MP3

Affected Products

Silverstripe/Graphql

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28104.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2023-28104.yaml · Exploit
• https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.1.2 · Patch
• https://github.com/silverstripe/silverstripe-graphql/pull/526 · Patch
• https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.2.3 · Patch
• https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-67g8-c724-8mp3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67g8-c724-8mp3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28104 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28104 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-graphql · Note
• https://t.me/cvenotify/46667 · Telegram Post
• https://t.me/cvenotify/46349 · Telegram Post
• https://silverstripe.org/download/security-releases/CVE-2023-28104 · Note
• https://t.me/cibsecurity/60172 · Telegram Post