CVE-2023-22951: Unauthorized admin-level access to TigerGraph Enterprise Free Edition 3.x REST API using insecurely stored authentication token

A vulnerability (CVE-2023-22951) has been discovered in TigerGraph Enterprise Free Edition 3.x, which could potentially provide an attacker with unauthorized admin-level access to all REST API endpoints. This issue stems from the creation and insecure storage of an authentication token for internal system use within the configuration file.

This detailed post will discuss the exploitation details of CVE-2023-22951, code snippets showcasing the vulnerability, and links to original references. The goal is to provide an all-encompassing and exclusive overview of this security issue and the potential impact it may bring to affected TigerGraph users.

Exploit Details

The vulnerability can be exploited by an attacker who has gained read access to the configuration file of TigerGraph Enterprise Free Edition 3.x. By obtaining the authentication token within this file, an attacker could make REST API calls with admin-level privileges to execute various actions and gain unauthorized access to sensitive data and system resources. This could potentially result in an extensive compromise of the affected system.

Code Snippet

Below is a code snippet demonstrating how the authentication token is insecurely stored within the configuration file (tg_config.conf):

# tg_config.conf
...
# Auth Token for internal systems
auth_token = "98ab12c34567d890ef12345678a05123"
...

Using this insecurely stored authentication token ("98ab12c34567d890ef12345678a05123" in this example), an attacker would be able to interact with the REST API using anonymous admin-level privileges. Here's a sample code snippet showcasing how an attacker could make an API call leveraging the obtained token:

import requests

url = "https://target_server:14240/endpoint";
headers = {
    "Authorization": "Bearer 98ab12c34567d890ef12345678a05123",
    "Content-Type": "application/json",
}
payload = {
    "data": "malicious_request_data",
}

response = requests.post(url, headers=headers, json=payload)

print(response.json())

For more information on CVE-2023-22951, please consult the following resources

1. CVE-2023-22951 - National Vulnerability Database (NIST)
2. TigerGraph Security Advisory (TSA-2023-1)

Conclusion

The vulnerability (CVE-2023-22951) discovered in TigerGraph Enterprise Free Edition 3.x allows an attacker with read access to the configuration file to obtain an authentication token and gain anonymous admin-level privileges on all REST API endpoints. It is crucial for affected users to apply appropriate security patches and follow best practices for securing their systems to mitigate any potential exploitation of this vulnerability.

Users are advised to monitor TigerGraph's security advisories and the National Vulnerability Database (NVD) for updated information on this vulnerability, along with other potential security issues that may arise.

By understanding the potential risks and exploitation details of CVE-2023-22951, users can better prepare their systems and stay vigilant against unauthorized access attempts.

Timeline

Published on: 04/13/2023 20:15:00 UTC
Last modified on: 04/24/2023 14:43:00 UTC