CVE-2024-37843: Craftcms Craft CMS SQLi Vulnerability

CVE-2024-37843 Overview

CVE-2024-37843 is a SQL injection vulnerability affecting Craft CMS versions up to v3.7.31. The vulnerability exists within the GraphQL API endpoint, allowing attackers to inject malicious SQL queries through specially crafted GraphQL requests. This unauthenticated SQL injection flaw poses severe risks to organizations running affected versions of Craft CMS, potentially enabling complete database compromise.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability through the GraphQL API to access, modify, or delete sensitive data from the backend database, potentially leading to complete system compromise.

Affected Products

• Craft CMS versions up to and including v3.7.31
• Any deployment with GraphQL API endpoint enabled
• Craft CMS installations with network-accessible GraphQL endpoints

Discovery Timeline

• 2024-06-25 - CVE-2024-37843 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37843

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in Craft CMS's GraphQL API endpoint. The vulnerability allows unauthenticated attackers to inject arbitrary SQL commands through the GraphQL interface. The attack requires no privileges and can be executed remotely over the network without user interaction. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the database and potentially the underlying system.

Root Cause

The root cause of CVE-2024-37843 lies in improper input sanitization within the GraphQL API query processing logic. User-supplied input passed through GraphQL queries is not adequately validated or parameterized before being incorporated into SQL statements. This allows malicious actors to break out of the intended query context and inject arbitrary SQL commands that are executed by the database.

Attack Vector

The attack vector is network-based, targeting the GraphQL API endpoint exposed by Craft CMS installations. Attackers can craft malicious GraphQL queries containing SQL injection payloads that bypass input validation. Since the vulnerability requires no authentication, any network-accessible Craft CMS installation with GraphQL enabled is potentially vulnerable. The attacker sends specially crafted GraphQL requests to the API endpoint, where the injected SQL commands are processed and executed against the backend database.

Detailed technical analysis of the exploitation technique is available in the Smith Security Blog Post, which documents the unauthenticated SQL injection vector via GraphQL.

Detection Methods for CVE-2024-37843

Indicators of Compromise

• Unusual or malformed GraphQL queries in web server access logs containing SQL syntax characters such as single quotes, semicolons, or UNION statements
• Database error messages appearing in application logs indicating SQL syntax errors
• Unexpected database queries or data access patterns in database audit logs
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting GraphQL endpoints
• Implement application-level logging for all GraphQL API requests and analyze for anomalous query structures
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attempts in HTTP POST bodies
• Review database query logs for unauthorized SELECT, UNION, or administrative SQL commands

Monitoring Recommendations

• Enable comprehensive logging on the GraphQL API endpoint and forward logs to a SIEM solution
• Configure alerting for error responses from the GraphQL endpoint that may indicate injection attempts
• Monitor for unusual database connection patterns or query execution times
• Implement rate limiting on GraphQL endpoints to detect and slow enumeration attempts

How to Mitigate CVE-2024-37843

Immediate Actions Required

• Upgrade Craft CMS to a patched version beyond v3.7.31 immediately
• If immediate patching is not possible, disable the GraphQL API endpoint until the update can be applied
• Implement web application firewall (WAF) rules to filter SQL injection patterns in GraphQL requests
• Review database audit logs for evidence of exploitation and assess potential data compromise

Patch Information

Organizations should update Craft CMS to the latest available version that addresses this vulnerability. Consult the official Craft CMS release notes and security advisories for specific patch information. The Smith Security Blog Post provides additional context on the vulnerability that may assist in remediation efforts.

Workarounds

• Disable the GraphQL API endpoint entirely if it is not required for business operations
• Implement network-level access controls to restrict GraphQL endpoint access to trusted IP addresses only
• Deploy a WAF with SQL injection detection rules specifically configured for GraphQL payloads
• Enable prepared statements and parameterized queries at the application layer if custom code interacts with the database

# Example: Disable GraphQL in Craft CMS config/general.php
# Add or modify the following configuration
'enableGql' => false,

# Alternative: Restrict GraphQL to authenticated users only
# In config/general.php
'enableGql' => true,
'enableGraphqlIntrospection' => false,