PT-2023-27221 · Unknown · @Keystone-6/Core

Dcousens · Published 2023-08-15 · Updated 2023-08-23 · CVE-2023-40027

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions @keystone-6/core versions prior to 5.5.1

Description The issue arises when ui.isAccessAllowed is set as undefined, making the adminMeta GraphQL query publicly accessible without requiring a session. This behavior differs from the default AdminUI middleware, which only allows public access if a session strategy is not defined. The vulnerability affects users who rely on their session strategy to restrict public access to adminMeta by default, similar to the AdminUI middleware's behavior. It does not affect developers using the @keystone-6/auth package or those who have defined their own ui.isAccessAllowed functionality.

Recommendations For versions prior to 5.5.1, upgrade to version 5.5.1 to resolve the issue. As a temporary workaround for users unable to upgrade, consider writing your own isAccessAllowed functionality to mitigate the vulnerability.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-40027

GHSA-9CVC-V7WM-992C

Affected Products

@Keystone-6/Core

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40027.json · Exploit
• https://github.com/keystonejs/keystone/commit/650e27e6e9b42abfb94c340c8470faf61f0ff284 · Patch
• https://github.com/keystonejs/keystone/security/advisories/GHSA-9cvc-v7wm-992c · Vendor Advisory
• https://github.com/keystonejs/keystone/pull/8771 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-40027 · Security Note
• https://osv.dev/vulnerability/GHSA-9cvc-v7wm-992c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40027 · Vendor Advisory
• https://github.com/keystonejs/keystone · Note
• https://github.com/keystonejs/keystone/releases/tag/2023-08-15 · Note
• https://twitter.com/CVEnew/status/1691508278398689290 · Twitter Post
• https://t.me/cvenotify/57132 · Telegram Post
• https://twitter.com/TechFishNews/status/1691553667068096693 · Twitter Post