PT-2023-31150 · Microsoft · Msgraph-Sdk-Php

Published 2023-12-05 · Updated 2023-12-12 · CVE-2023-49282

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions msgraph-sdk-php versions prior to 1.109.1 msgraph-sdk-php versions prior to 2.0.0-RC5

Description The Microsoft Graph PHP SDK contains a vulnerability that exposes system information through the phpinfo() function. This issue affects the GetPhpInfo.php script, which can be exploited if the server is misconfigured, for example, by making the PHP application's /vendor directory web accessible. An attacker can craft an HTTP request to execute the phpinfo() method, gaining access to system information like configuration, modules, and environment variables, and potentially using compromised secrets to access additional data.

Recommendations For versions prior to 1.109.1 and 2.0.0-RC5, update to the latest version. As a temporary workaround, consider deleting the vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php file. Alternatively, remove access to the /vendor directory to minimize the risk of exploitation. Disabling the phpinfo function can also serve as a temporary mitigation measure until a patch is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-49282

GHSA-CGWQ-6PRQ-8H9Q

Affected Products

Msgraph-Sdk-Php

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49282.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/microsoft/microsoft-graph/CVE-2023-49282.yaml · Exploit
• https://github.com/microsoftgraph/msgraph-sdk-php/security/advisories/GHSA-cgwq-6prq-8h9q · Vendor Advisory
• https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1 · Patch
• https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1 · Patch
• https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49282 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49282 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgwq-6prq-8h9q · Vendor Advisory
• https://github.com/microsoftgraph/msgraph-sdk-php · Note
• https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments · Note
• https://twitter.com/CVEnew/status/1732171117941404111 · Twitter Post
• https://t.me/cvenotify/63291 · Telegram Post
• https://twitter.com/RedPacketSec/status/1732704243650318414 · Twitter Post
• https://t.me/cvenotify/62416 · Telegram Post