Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in Craft CMS allows unauthorized access to modify content across different websites hosted on the same platform, even if the attacker only has credentials for a single site. This issue arises from an insufficient check on GraphQL tokens, potentially enabling malicious actors to create or delete content, categories, tags, and assets across multiple sites. The main concern is confirming relevance and exposure.
- GraphQL tokens can wrongly control other sites.
- Leaders should remember unauthorized content changes.
- Confirm if your sites are affected and exposed.
Attack Path
How an attacker could exploit the issue
An attacker could leverage a site-scoped GraphQL token to bypass authorization controls and manipulate content across different sites within Craft CMS. This bypass occurs because the `requireAllowedSite()` function is not consistently enforced, allowing a token intended for one site to be used for actions on another. The vulnerability can lead to unauthorized creation and deletion of content, including entries, categories, tags, and assets.
- Requires a site-scoped GraphQL token.
- Triggered via GraphQL mutation with a specific site ID.
- Risk: Cross-site content manipulation and deletion.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker with a GraphQL token from one site to modify or delete content, assets, and categories across other sites within the same Craft CMS installation. This is possible because the system does not properly enforce site scope restrictions for GraphQL tokens when performing mutations.
- Shared content and assets.
- Unauthorized mutation via GraphQL API.
- Content integrity compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects Craft CMS installations. The first step for security and infrastructure teams is to identify all instances of Craft CMS, determine their internet reachability and business criticality, and then pinpoint the accountable owner for each instance. Planning remediation or mitigation should be prioritized based on this risk assessment.
- Identify affected Craft CMS instances.
- Verify public exposure and business criticality.
- Plan risk-based remediation or mitigation.
