Denial of service vulnerability in silverstripe-graphql via recursive queries
CVE-2023-40180
What is CVE-2023-40180?
The silverstripe-graphql package, utilized for serving Silverstripe CMS data via GraphQL, contains a vulnerability that can be exploited through carefully crafted recursive queries. This could potentially allow an attacker to overwhelm a web server, resulting in a Denial of Service condition. This risk primarily impacts websites where GraphQL schemas are publicly exposed. If a site does not present a public GraphQL schema, the attacker would require a user account to initiate such an attack. Implementing a content delivery network (CDN) can further reduce the exposure to such vulnerabilities. Users are strongly advised to upgrade to versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3 to mitigate this risk.
Affected Version(s)
silverstripe-graphql >= 3.0.0, < 3.8.2 < 3.0.0, 3.8.2
silverstripe-graphql >= 4.0.0, < 4.1.3 < 4.0.0, 4.1.3
silverstripe-graphql >= 4.2.0, < 4.2.5 < 4.2.0, 4.2.5