CVE-2024-37843
📋 TL;DR
CVE-2024-37843 is an unauthenticated SQL injection vulnerability in Craft CMS's GraphQL API endpoint. Attackers can execute arbitrary SQL commands without authentication, potentially compromising the entire database. All Craft CMS installations up to version 3.7.31 are affected.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Database information disclosure, data manipulation, and potential administrative access to the CMS.
If Mitigated
Limited impact if GraphQL API is disabled or properly firewalled, though the vulnerability still exists in the codebase.
🎯 Exploit Status
Public technical details and proof-of-concept are available. The vulnerability requires no authentication and is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.32 and later
Vendor Advisory: https://craftcms.com/security
Restart Required: No
Instructions:
1. Update Craft CMS to version 3.7.32 or later via Composer: composer require craftcms/cms:^3.7.32
2. Run any required database migrations
3. Clear caches if necessary
🔧 Temporary Workarounds
Disable GraphQL API
allTemporarily disable the GraphQL API endpoint until patching is possible
Edit config/general.php and set 'enableGraphql' => false
Restrict GraphQL Access
linuxUse web server rules to restrict access to the GraphQL endpoint
For Apache: add location block for /api in .htaccess
For Nginx: add location block for /api in server config
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting GraphQL endpoints
- Restrict network access to the Craft CMS instance using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via composer show craftcms/cmsCheck Version:
composer show craftcms/cms | grep versionsVerify Fix Applied:
Confirm version is 3.7.32 or later and test GraphQL endpoint with known payloads📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL queries with SQL syntax
- Multiple failed GraphQL requests with injection patterns
- Database error logs showing SQL syntax errors
Network Indicators:
- POST requests to /api containing SQL keywords in GraphQL queries
- Unusual traffic patterns to GraphQL endpoint
SIEM Query:
source="web_logs" AND (uri_path="/api" OR uri_path="/graphql") AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT *" OR request_body CONTAINS "information_schema")