SilverStripe graphql up to 4.3.6/5.1.2 authorization

Summaryinfo

A vulnerability marked as problematic has been reported in SilverStripe graphql up to 4.3.6/5.1.2. The affected element is an unknown function. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2023-44401. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in SilverStripe graphql up to 4.3.6/5.1.2 (Content Management System). This affects an unknown code. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality. The summary by CVE is:

The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page. Note that this also affects GraphQL queries which have a limit applied, even if the query isn’t paginated per se. This has been fixed in versions 4.3.7 and 5.1.3 by ensuring no new records are pulled in from the database after performing `canView` permission checks for each page of results. This may result in some pages in the query results having less than the maximum number of records per page even when there are more pages of results. This behavior is consistent with how pagination works in other areas of Silverstripe CMS, such as in `GridField`, and is a result of having to perform permission checks in PHP rather than in the database directly. One may disable these permission checks by disabling the `CanViewPermission` plugin.

The weakness was shared 01/23/2024. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2023-44401 since 09/28/2023. Neither technical details nor an exploit are publicly available.

Upgrading to version 4.3.7 or 5.1.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• SilverStripe

Name

• graphql

Version

• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.3.4
• 4.3.5
• 4.3.6
• 5.1.0
• 5.1.1
• 5.1.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion