PT-2023-31151 · Microsoft · Microsoft-Graph-Core

Published 2023-12-05 · Updated 2023-12-12 · CVE-2023-49283

Positive Technologies · (AI Summary)

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions microsoft-graph-core versions prior to 2.0.2

Description The Microsoft Graph Beta PHP SDK contains test code that enables the use of the phpInfo() function from any application that can access and execute the file at vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php. This function exposes system information. The vulnerability requires a server misconfiguration to be present, such as making the PHP application's /vendor directory web accessible. An attacker can craft an HTTP request to execute the phpinfo() method, gaining access to system information like configuration, modules, and environment variables, which can be used to access additional data.

Recommendations For versions prior to 2.0.2, update to version 2.0.2 to resolve the issue. As a temporary workaround, consider deleting the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php file. Alternatively, remove access to the /vendor directory to minimize the risk of exploitation. Disabling the phpinfo function can also serve as a temporary mitigation measure until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-49283

GHSA-MHHP-C3CM-2R86

Affected Products

Microsoft-Graph-Core

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49283.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/microsoft/microsoft-graph-core/CVE-2023-49283.yaml · Exploit
• https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1 · Patch
• https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1 · Patch
• https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86 · Vendor Advisory
• https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2 · Patch
• https://osv.dev/vulnerability/GHSA-mhhp-c3cm-2r86 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49103 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49283 · Vendor Advisory
• https://github.com/microsoftgraph/msgraph-sdk-php-core · Note
• https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments · Note
• https://twitter.com/CVEnew/status/1732171116985061486 · Twitter Post
• https://t.me/cvenotify/62417 · Telegram Post
• https://t.me/cvenotify/62512 · Telegram Post