Homepage

Server-side Request Forgery (SSRF) Affecting wp-graphql/wp-graphql package, versions <1.14.6

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.06% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-WPGRAPHQLWPGRAPHQL-5750293
  • published2 Jul 2023
  • disclosed30 Jun 2023
  • creditUnknown
Report a new vulnerability Found a mistake?

Introduced: 30 Jun 2023

CVE-2023-23684  (opens in a new tab)
CWE-918  (opens in a new tab)

How to fix?

Upgrade wp-graphql/wp-graphql to version 1.14.6 or higher.

Overview

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). Authenticated users making GraphQL requests that execute the createMediaItem could pass executable paths in the mutations filePath argument that could give them unwarranted access to the server.

Workaround

If you cannot upgrade to v1.14.6 or higher, you should be able to use the following snippet in your functions.php to override the vulnerable resolver. 

add_filter( 'graphql_pre_resolve_field', function( $nil, $source, $args, $context, \GraphQL\Type\Definition\ResolveInfo $info, $type_name, $field_key, $field, $field_resolver ) {


if ( $info-&gt;fieldName !== &#39;createMediaItem&#39; ) {
    return $nil;
}

$input = $args[&#39;input&#39;] ?? null;

    if ( ! isset( $input[&#39;filePath&#39;] ) ) {
    return $nil;
}

$uploaded_file_url   = $input[&#39;filePath&#39;];

// Check that the filetype is allowed
$check_file = wp_check_filetype( $uploaded_file_url );

// if the file doesn&#39;t pass the check, throw an error
if ( ! $check_file[&#39;ext&#39;] || ! $check_file[&#39;type&#39;] || ! wp_http_validate_url( $uploaded_file_url ) ) {
    throw new \GraphQL\Error\UserError( sprintf( __( &#39;Invalid filePath &quot;%s&quot;&#39;, &#39;wp-graphql&#39; ), $input[&#39;filePath&#39;] ) );
}

$protocol = wp_parse_url( $input[&#39;filePath&#39;], PHP_URL_SCHEME );

// prevent the filePath from being submitted with a non-allowed protocols
$allowed_protocols = [ &#39;https&#39;, &#39;http&#39;, &#39;file&#39; ];

if ( ! in_array( $protocol, $allowed_protocols, true ) ) {
    throw new \GraphQL\Error\UserError( sprintf( __( &#39;Invalid protocol. &quot;%1$s&quot;. Only &quot;%2$s&quot; allowed.&#39;, &#39;wp-graphql&#39; ), $protocol, implode( &#39;&quot;, &quot;&#39;, $allowed_protocols ) ) );
}

return $nil;



}, 10, 9 );
``

CVSS Scores

version 3.1