PT-2023-27310 · Silverstripe · Silverstripe/Graphql

Jason Nguyen · Published 2023-10-16 · Updated 2023-10-23 · CVE-2023-40180

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions silverstripe-graphql versions prior to 3.8.2 silverstripe-graphql versions prior to 4.1.3 silverstripe-graphql versions prior to 4.2.5 silverstripe-graphql versions prior to 4.3.4 silverstripe-graphql versions prior to 5.0.3

Description The issue affects silverstripe-graphql, a package that serves Silverstripe data in GraphQL representations. An attacker could use a recursive GraphQL query to execute a Distributed Denial of Service (DDOS) attack against a website. This mostly affects websites with publicly exposed GraphQL schemas. If the Silverstripe CMS project does not expose a public-facing GraphQL schema, a user account is required to trigger the DDOS attack. Hosting the site behind a content delivery network (CDN), such as Imperva or CloudFlare, may further mitigate the risk.

Recommendations For versions prior to 3.8.2, upgrade to version 3.8.2 or later. For versions prior to 4.1.3, upgrade to version 4.1.3 or later. For versions prior to 4.2.5, upgrade to version 4.2.5 or later. For versions prior to 4.3.4, upgrade to version 4.3.4 or later. For versions prior to 5.0.3, upgrade to version 5.0.3 or later. As a temporary workaround, consider restricting access to the GraphQL schema to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-40180

GHSA-V23W-PPPM-JH66

Affected Products

Silverstripe/Graphql

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40180.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2023-40180.yaml · Exploit
• https://github.com/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d2501c · Patch
• https://osv.dev/vulnerability/GHSA-v23w-pppm-jh66 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40180 · Security Note
• https://silverstripe.org/download/security-releases/CVE-2023-40180 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40180 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-v23w-pppm-jh66 · Note
• https://github.com/silverstripe/silverstripe-graphql/tree/3.8#recursive-or-complex-queries · Note
• https://github.com/silverstripe/silverstripe-graphql · Note
• https://twitter.com/VulmonFeeds/status/1714016348248875444 · Twitter Post
• https://t.me/cibsecurity/72331 · Telegram Post
• https://twitter.com/cracbot/status/1714396841964601487 · Twitter Post
• https://twitter.com/CVEnew/status/1713988511177580846 · Twitter Post
• https://docs.silverstripe.org/en/developer_guides/graphql/security_and_best_practices/recursive_or_complex_queries · Note