CVE-2023-49283: Vulnerability in microsoft/microsoft-graph-core package exposes phpinfo()
Summary
CVE-2023-49283: Test code in published microsoft-graph-core package exposes phpinfo(). Affects microsoft/microsoft-graph-core versions < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The microsoft/microsoft-graph-core package is a PHP SDK for the Microsoft Graph API. It provides a set of classes and methods to interact with the Microsoft Graph service. The package is widely used by developers to integrate Microsoft Graph functionality into their PHP applications. However, a vulnerability has been discovered in the package that exposes the phpinfo() function, which can reveal sensitive system information.
Vulnerability Detail
The vulnerability in the microsoft/microsoft-graph-core package allows any application with access to the file at vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php to execute the phpinfo() function. This function displays detailed information about the PHP environment, including configuration settings, loaded modules, and environment variables. The vulnerability requires a misconfiguration of the server, such as making the PHP application's /vendor directory web accessible. An attacker can exploit this vulnerability by crafting an HTTP request to execute the phpinfo() method, gaining access to sensitive system information. This information can be used to further compromise the system and access additional data.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
composer require microsoft/microsoft-graph-core:2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate deployment with the updated vendor package is not possible, the following temporary workarounds can be implemented:
- Delete the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php file.
- Remove access to the /vendor directory to prevent execution of the phpinfo() function.
- Disable the phpinfo function in the PHP configuration.
Conclusion
The microsoft/microsoft-graph-core package is vulnerable to a phpinfo() exposure vulnerability. It is crucial to update the package to version 2.0.2 or later and deploy the updated vendor package to the server. Additionally, removing the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php file and restricting access to the /vendor directory are recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for microsoft/microsoft-graph-core →
FAQ
The vulnerability allows an attacker to execute the phpinfo() function, which exposes sensitive system information. This information can be used to gain further access to the system and potentially compromise data.
To fix the vulnerability, update the microsoft/microsoft-graph-core package to version 2.0.2 or later. Ensure that the updated vendor package is deployed to the server. It is also recommended to remove the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php file and restrict access to the /vendor directory.
Yes, if an immediate deployment with the updated vendor package is not possible, you can delete the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php file, remove access to the /vendor directory, or disable the phpinfo function in the PHP configuration.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity.
You can find more information about this vulnerability, including the patch and references, in the following sources:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49283
- GitHub Advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-mhhp-c3cm-2r86/GHSA-mhhp-c3cm-2r86.json
- OwnCloud Security Advisories: https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
