CVE-2023-28481
📋 TL;DR
This vulnerability in TigerGraph Enterprise 3.7.0 allows any code running as the tigergraph user to write arbitrary SSH public keys to the authorized_keys file. This enables attackers to gain password-less SSH access to the system. Organizations running TigerGraph Enterprise 3.7.0 are affected.
💻 Affected Systems
- TigerGraph Enterprise
📦 What is this software?
Tigergraph by Tigergraph
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through SSH key injection leading to unauthorized access, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized SSH access to the TigerGraph server, allowing attackers to execute commands as the tigergraph user and potentially escalate privileges.
If Mitigated
Limited impact if proper access controls, network segmentation, and monitoring are in place to detect unauthorized SSH key modifications.
🎯 Exploit Status
Exploitation requires code execution as the tigergraph user, which could be achieved through other vulnerabilities or misconfigurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.1 or later
Vendor Advisory: https://neo4j.com/security/cve-2023-28481/
Restart Required: Yes
Instructions:
1. Backup your TigerGraph data and configuration. 2. Download and install TigerGraph Enterprise 3.7.1 or later from the official vendor website. 3. Follow the vendor's upgrade documentation. 4. Restart the TigerGraph services.
🔧 Temporary Workarounds
Restrict SSH authorized_keys file permissions
linuxChange permissions on the authorized_keys file to prevent unauthorized writes
chmod 600 /home/tigergraph/.ssh/authorized_keys
chown tigergraph:tigergraph /home/tigergraph/.ssh/authorized_keys
Monitor SSH key modifications
linuxSet up file integrity monitoring on the authorized_keys file
auditctl -w /home/tigergraph/.ssh/authorized_keys -p wa -k tigergraph_ssh_keys
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized code execution as the tigergraph user
- Monitor and alert on any modifications to the /home/tigergraph/.ssh/authorized_keys file
🔍 How to Verify
Check if Vulnerable:
Check if TigerGraph version is 3.7.0 and verify permissions on /home/tigergraph/.ssh/authorized_keys with 'ls -la /home/tigergraph/.ssh/authorized_keys'Check Version:
gadmin versionVerify Fix Applied:
Verify TigerGraph version is 3.7.1 or later and confirm authorized_keys file permissions are 600 with proper ownership📡 Detection & Monitoring
Log Indicators:
- Unauthorized modifications to /home/tigergraph/.ssh/authorized_keys
- Unexpected SSH login attempts as tigergraph user
Network Indicators:
- Unexpected SSH connections to TigerGraph server on port 22
SIEM Query:
source="auth.log" AND (user="tigergraph" OR file="/home/tigergraph/.ssh/authorized_keys")