CVE-2023-28104

Executive Summary

CVE-2023-28104 is a denial of service vulnerability in the silverstripe/graphql package, which serves Silverstripe CMS data through GraphQL representations. Versions 4.2.2 and 4.1.1 are affected, allowing an attacker to craft a specially constructed GraphQL query that can trigger a denial of service condition against websites with publicly exposed GraphQL endpoints. The vulnerability is particularly impactful against deployments with large or complex GraphQL schemas. Successful exploitation results in service unavailability, with a CVSS score of 7.5 (High severity) reflecting the ease of exploitation over the network without authentication.

Technical Analysis

The vulnerability resides in the silverstripe/graphql package, an extension that provides GraphQL API capabilities to Silverstripe CMS installations. The core issue is that the GraphQL query parser/execution engine in versions 4.1.1 and 4.2.2 does not adequately limit the computational complexity of incoming GraphQL queries.

GraphQL APIs by design allow clients to request nested data structures in a single query. A maliciously crafted query can exploit the recursive nature of GraphQL's type system to force the server to traverse an exponentially large number of nodes, effectively exhausting CPU and memory resources on the server. This class of abuse is typically referred to as a GraphQL "resource exhaustion" or "complexity attack" and does not require authentication when the GraphQL endpoint is publicly accessible.

The attack surface is the publicly exposed GraphQL endpoint (typically exposed at a path serving the GraphQL API). Any website running Silverstripe CMS with the graphql module enabled and publicly accessible is potentially vulnerable. Websites that have customized or extended their GraphQL schemas with additional types, fields, and relationships are at greater risk because the complexity of queries that can be constructed increases with schema complexity.

The vulnerability does not rely on a specific crafted payload with a known signature; rather, it abuses the legitimate functionality of GraphQL query nesting combined with inadequate query depth/cost limiting. The nature of the flaw means that the same query that causes harm would appear as a well-formed GraphQL request to standard monitoring tools.

It is important to note the patch confidence level for this vulnerability is 0/4, indicating no patch evidence from any tracked source was available during the assessment period. However, the NVD description explicitly states that users should upgrade to silverstripe/graphql 4.2.3 or 4.1.2 to remedy the vulnerability, which suggests the vendor did release patched versions. The discrepancy between the known fix versions and the 0/4 patch confidence suggests a reporting lag rather than an absence of vendor fixes.

Exploitation Scenarios

Reconnaissance/Target Identification: The attacker first identifies Silverstripe CMS websites that have a publicly exposed GraphQL endpoint. This can be done by fingerprinting the web application (identifying Silverstripe through response headers, page structure, or known file paths) and then probing for the GraphQL endpoint by sending a generic introspection query to detect if a GraphQL service responds.

Triggering the Flaw: Once the GraphQL endpoint is confirmed, the attacker crafts a GraphQL query that exploits the recursive/complex nature of the schema. The attack leverages the fact that the GraphQL engine does not enforce adequate query depth limits, allowing the attacker to nest selections deeply or request wide fan-out on relationship fields.

Payload/Execution Method: Since no specific payload details are available from the NVD description, the attack is described at the vulnerability-class level: the attacker generates a query (or set of queries) that forces the server to traverse the GraphQL schema in a way that results in exponentially increasing processing. This typically involves aliases, deeply nested fields, or querying the same expensive field multiple times. The server's GraphQL resolver executes the query, consuming excessive CPU and memory resources until the service becomes unresponsive or crashes. No public PoC is available; the attack chain is inferred from the vulnerability class (GraphQL complexity attacks).

Post-Exploitation Impact: The immediate impact is denial of service — the website becomes slow or completely unresponsive to legitimate users. In a Silverstripe CMS context, this affects not only the GraphQL API but potentially the entire web application if the resource exhaustion takes down the application server or the underlying infrastructure (e.g., consumes all available memory on the host). The attack does not require authentication and can be repeated to prolong the DoS condition. There is no data exfiltration or integrity compromise; the impact is purely availability-related.

Impact Assessment

The vulnerability carries a CVSS score of 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vector highlights the most dangerous aspects: the attack is exploitable over the network (AV:N) without any authentication (PR:N) and without user interaction (UI:N). The only impact component is availability (A:H), indicating a severe impact on system availability, while confidentiality and integrity are not affected.

The blast radius includes any public-facing website built on Silverstripe CMS that has enabled the graphql module. Sites with large, complex, or heavily customized GraphQL schemas are most at risk, as the attack's effectiveness scales with schema complexity. Since Silverstripe CMS is used for content-managed websites including government, educational, and corporate platforms, a successful DoS attack could result in service outages affecting public-facing services and business-critical web applications.

The EPSS score of 0.01055 (61.3rd percentile) suggests that exploitation activity is not widespread, but the score indicates it is in the upper half of actively exploited vulnerabilities, meaning the probability of exploitation in the wild is non-trivial. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of public PoC or exploit code at the time of assessment.

From a business perspective, the primary consequences include: downtime and loss of revenue for e-commerce or service-oriented sites; reputational damage from service unavailability; potentially cascading failures if shared infrastructure is impacted; and operational overhead for incident response and service restoration.

Detection Guidance

Sigma Rule

title: Suspicious GraphQL Query Complexity - Possible DoS Attempt
id: 6f5a54a4-2e9b-4f2e-8e0c-2e0a5a8e6d9b
status: experimental
description: Detects GraphQL queries with excessive depth or breadth that may indicate an attempted denial of service attack against silverstripe/graphql.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-28104
date: 2024/01/15
tags:
    - attack.t1499
    - attack.endpoint_denial_of_service
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains|all:
            - 'graphql'
        cs-uri-query|contains:
            - '__schema'
            - 'query'
    keywords:
        - 'Max'
        - 'depth'
        - 'cost'
    condition: selection and keywords
falsepositives:
    - Legitimate complex queries from API consumers
level: medium

YARA Rule

rule CVE_2023_28104_Silverstripe_GraphQL_DoS
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects GraphQL queries targeting Silverstripe that may indicate DoS attempts"
        cve = "CVE-2023-28104"
        severity = "high"
    strings:
        $s1 = "query" ascii nocase
        $s2 = "graphql" ascii nocase
        $s3 = "__schema" ascii nocase
        $s4 = "aliases" ascii nocase
        $s5 = "{" ascii
    condition:
        uint16(0) == 0x0a0a and
        2 of ($s*) and filesize < 100KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-28104 - Silverstripe GraphQL DoS Attempt"; flow:established,to_server; content:"POST"; http_method; content:"graphql"; http_uri; content:"query"; http_client_body; pcre:"/query[\s]*\{/"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; reference:cve,2023-28104; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-28104; sid:20230901; rev:1;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=30s
  [ network where event.outcome == "success" and network.protocol == "http"
    and http.request.method == "POST" and url.path contains "graphql"
    and http.request.body.content contains "query" ]
  [ network where event.outcome == "success" and network.protocol == "http"
    and http.request.method == "POST" and url.path contains "graphql"
    and http.request.body.content contains "query"
    and http.request.body.bytes > 10000 ]
  [ network where event.outcome == "success" and network.protocol == "http"
    and http.request.method == "POST" and url.path contains "graphql"
    and http.request.body.content contains "query"
    and http.request.body.bytes > 10000 ]

Splunk SPL Query

index=web sourcetype=access_combined status=200
| search "/graphql" method=POST
| eval query_length=len(_raw)
| where query_length > 5000
| stats count BY src_ip, uri_path
| where count > 10
| table _time, src_ip, uri_path, count, query_length

Wazuh OSSEC Rule

<group name="web,graphql,dos,">
  <rule id="100283" level="10">
    <if_sid>31122</if_sid>
    <description>CVE-2023-28104 - Potential GraphQL Denial of Service Attack</description>
    <field name="url">\.*graphql\.*</field>
    <field name="method">POST</field>
    <regex>query</regex>
    <group>attack.t1499,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED based on tracked sources, though the NVD description references patched versions 4.2.3 and 4.1.2.

1. Immediate Mitigations:

   • Restrict public access to the GraphQL endpoint by IP allowlisting or authentication, if the API is intended for internal use only.
   • Implement reverse proxy-level rate limiting on the GraphQL endpoint to throttle requests per source IP.
   • Deploy a Web Application Firewall (WAF) rule to inspect GraphQL query complexity and block requests exceeding a defined depth threshold.
   • Monitor server resource utilization (CPU/memory) and set alerting thresholds to detect abnormal spikes.

2. Patch/Upgrade Steps:

   • Upgrade silverstripe/graphql to version 4.2.3 or 4.1.2 as specified in the NVD description. This is the most direct remediation.
   • Verify the Composer dependencies in the Silverstripe project and ensure the patched version is locked.
   • If the upgrade is not immediately possible, apply vendor-provided patches or hotfixes when available.
   • After patching, test the GraphQL endpoint thoroughly to ensure normal functionality is retained and that the fix does not break legitimate API consumers.

3. Long-Term Hardening:

   • Implement GraphQL query depth and complexity limits at the application layer using middleware, as a defense-in-depth measure.
   • Enable persistent caching of expensive query results where feasible.
   • Regularly audit public API endpoints for exposure and restrict to least-privilege access.
   • Subscribe to vendor security advisories for Silverstripe and maintain a regular patch management cadence.
   • Conduct periodic penetration testing of the GraphQL API to identify query complexity abuse vectors before attackers do.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-28104
2. Silverstripe Security Advisory (vendor advisory for silverstripe/graphql): https://www.silverstripe.org/download/security-releases/
3. OWASP GraphQL Cheat Sheet (resource on GraphQL DoS prevention): https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html
4. CVE.org record: https://cve.org/CVERecord?id=CVE-2023-28104

Threat Actor Campaigns: No known threat actor campaigns have been publicly attributed to this CVE. The CVE is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild from the data provided. The EPSS score indicates some likelihood of exploitation, but no specific campaign or exploit-in-the-wild evidence is available at the time of this report.