CVE-2023-22951
📋 TL;DR
CVE-2023-22951 is an authentication bypass vulnerability in TigerGraph Enterprise Free Edition where an internal authentication token is stored in a readable configuration file. Attackers who obtain this token gain anonymous admin-level privileges on all REST API endpoints. This affects TigerGraph Enterprise Free Edition 3.x installations.
💻 Affected Systems
- TigerGraph Enterprise Free Edition
📦 What is this software?
Cloud by Tigergraph
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the TigerGraph instance allowing data exfiltration, data manipulation, service disruption, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to sensitive graph data, configuration changes, and potential data corruption or deletion.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized access to the configuration file and REST API endpoints.
🎯 Exploit Status
Exploitation requires reading the configuration file to obtain the token, then using it in REST API requests. No authentication is required to use the token once obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check TigerGraph vendor advisory for specific patched versions
Vendor Advisory: https://dev.tigergraph.com/forum/c/tg-community/announcements/35
Restart Required: Yes
Instructions:
1. Review TigerGraph security advisory. 2. Upgrade to a patched version. 3. Restart TigerGraph services. 4. Regenerate authentication tokens if necessary.
🔧 Temporary Workarounds
Restrict Configuration File Access
linuxSet strict file permissions on TigerGraph configuration files to prevent unauthorized reading of the authentication token.
chmod 600 /path/to/tigergraph/config/file
chown tigergraph:tigergraph /path/to/tigergraph/config/file
Network Access Controls
linuxRestrict network access to TigerGraph REST API endpoints using firewall rules or network segmentation.
iptables -A INPUT -p tcp --dport 14240 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 14240 -j DROP
🧯 If You Can't Patch
- Implement strict file system permissions on all TigerGraph configuration files and directories
- Deploy network segmentation and firewall rules to restrict access to TigerGraph REST API endpoints
🔍 How to Verify
Check if Vulnerable:
Check if TigerGraph configuration files contain authentication tokens that are readable by unauthorized users. Review file permissions on configuration files.Check Version:
gdb version or check TigerGraph documentation for version commandVerify Fix Applied:
After patching, verify that authentication tokens are properly secured and cannot be read by unauthorized users. Test REST API endpoints require proper authentication.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to configuration files
- REST API requests with unexpected authentication tokens
- Admin-level API calls from unexpected sources
Network Indicators:
- Unusual REST API traffic patterns
- Authentication bypass attempts on API endpoints
SIEM Query:
source="tigergraph" AND (event="config_access" OR event="auth_bypass" OR user="anonymous" AND privilege="admin")