CVE-2023-49283 in msgraph-sdk-php-core
Summary
by MITRE • 12/06/2023
microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/24/2023
The vulnerability identified as CVE-2023-49283 resides within the Microsoft Graph Core library for PHP, specifically affecting the Microsoft Graph Beta PHP SDK packages. This security flaw manifests through the inclusion of test code within production packages that exposes the phpinfo() function to unauthorized users. The affected file GetPhpInfo.php contains a direct call to phpinfo() which reveals sensitive system information including configuration settings, loaded modules, and environment variables. This represents a critical security oversight where development and testing artifacts were inadvertently packaged for production use, violating fundamental security principles of least privilege and separation of concerns.
The technical exploitation of this vulnerability requires a specific server misconfiguration where the vendor directory becomes web-accessible. This misconfiguration creates an attack surface that allows remote execution of the malicious script through crafted HTTP requests targeting the GetPhpInfo.php file. The phpinfo() function itself is inherently non-executive but serves as a information disclosure mechanism that reveals comprehensive system details. According to CWE-489, this vulnerability aligns with the weakness of retained test code in production environments, while the server misconfiguration represents a classic path to privilege escalation through improper access controls. The ATT&CK framework categorizes this under T1082 (System Information Discovery) and T1592 (Gather Victim Host Information) as it enables adversaries to collect system information that can be leveraged for further attacks.
The operational impact of this vulnerability extends beyond simple information disclosure, as the exposed system details can serve as a foundation for more sophisticated attacks. An attacker who successfully exploits this vulnerability gains visibility into the PHP environment configuration, including available extensions, security settings, and potentially sensitive environment variables that might contain credentials or other secrets. This information can be used to craft targeted attacks against specific PHP configurations or to identify other potential vulnerabilities within the system. The vulnerability's severity is amplified by the fact that it requires only a misconfigured server to become exploitable, making it particularly dangerous in environments where proper security hardening has not been implemented.
The vulnerability has been addressed in version 2.0.2 of the Microsoft Graph Core library, which removes the test code from production packages. Organizations without immediate access to the updated package can implement several temporary mitigations to reduce risk. The most effective immediate actions include deleting the vulnerable GetPhpInfo.php file from the vendor directory, restricting web access to the vendor directory entirely, or disabling the phpinfo() function system-wide through PHP configuration. These mitigations align with security best practices outlined in the OWASP Top Ten and NIST cybersecurity frameworks, emphasizing the importance of proper access controls and the principle of least privilege. The vulnerability demonstrates the critical importance of thorough security testing during the release process and the necessity of maintaining clear separation between development, testing, and production environments to prevent accidental exposure of sensitive functionality.