CVE-2024-37843: Craftcms Craft CMS SQLi Vulnerability

CVE-2024-37843 Overview

CVE-2024-37843 is a SQL injection vulnerability affecting Craft CMS versions up to v3.7.31. The vulnerability exists within the GraphQL API endpoint, allowing attackers to inject malicious SQL queries through specially crafted GraphQL requests. This unauthenticated SQL injection flaw poses severe risks to organizations running affected versions of Craft CMS, potentially enabling complete database compromise.

Critical Impact
Unauthenticated attackers can exploit this SQL injection vulnerability through the GraphQL API to access, modify, or delete sensitive data from the backend database, potentially leading to complete system compromise.

Affected Products

Craft CMS versions up to and including v3.7.31
Any deployment with GraphQL API endpoint enabled
Craft CMS installations with network-accessible GraphQL endpoints

Discovery Timeline

2024-06-25 - CVE-2024-37843 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37843

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in Craft CMS's GraphQL API endpoint. The vulnerability allows unauthenticated attackers to inject arbitrary SQL commands through the GraphQL interface. The attack requires no privileges and can be executed remotely over the network without user interaction. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the database and potentially the underlying system.

Root Cause

The root cause of CVE-2024-37843 lies in improper input sanitization within the GraphQL API query processing logic. User-supplied input passed through GraphQL queries is not adequately validated or parameterized before being incorporated into SQL statements. This allows malicious actors to break out of the intended query context and inject arbitrary SQL commands that are executed by the database.

Attack Vector

The attack vector is network-based, targeting the GraphQL API endpoint exposed by Craft CMS installations. Attackers can craft malicious GraphQL queries containing SQL injection payloads that bypass input validation. Since the vulnerability requires no authentication, any network-accessible Craft CMS installation with GraphQL enabled is potentially vulnerable. The attacker sends specially crafted GraphQL requests to the API endpoint, where the injected SQL commands are processed and executed against the backend database.

Detailed technical analysis of the exploitation technique is available in the Smith Security Blog Post, which documents the unauthenticated SQL injection vector via GraphQL.

Detection Methods for CVE-2024-37843

Indicators of Compromise

Unusual or malformed GraphQL queries in web server access logs containing SQL syntax characters such as single quotes, semicolons, or UNION statements
Database error messages appearing in application logs indicating SQL syntax errors
Unexpected database queries or data access patterns in database audit logs
Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

Monitor web application firewall (WAF) logs for SQL injection patterns targeting GraphQL endpoints
Implement application-level logging for all GraphQL API requests and analyze for anomalous query structures
Deploy intrusion detection systems (IDS) with signatures for SQL injection attempts in HTTP POST bodies
Review database query logs for unauthorized SELECT, UNION, or administrative SQL commands

Monitoring Recommendations

Enable comprehensive logging on the GraphQL API endpoint and forward logs to a SIEM solution
Configure alerting for error responses from the GraphQL endpoint that may indicate injection attempts
Monitor for unusual database connection patterns or query execution times
Implement rate limiting on GraphQL endpoints to detect and slow enumeration attempts

How to Mitigate CVE-2024-37843

Immediate Actions Required

Upgrade Craft CMS to a patched version beyond v3.7.31 immediately
If immediate patching is not possible, disable the GraphQL API endpoint until the update can be applied
Implement web application firewall (WAF) rules to filter SQL injection patterns in GraphQL requests
Review database audit logs for evidence of exploitation and assess potential data compromise

Patch Information

Organizations should update Craft CMS to the latest available version that addresses this vulnerability. Consult the official Craft CMS release notes and security advisories for specific patch information. The Smith Security Blog Post provides additional context on the vulnerability that may assist in remediation efforts.

Workarounds

Disable the GraphQL API endpoint entirely if it is not required for business operations
Implement network-level access controls to restrict GraphQL endpoint access to trusted IP addresses only
Deploy a WAF with SQL injection detection rules specifically configured for GraphQL payloads
Enable prepared statements and parameterized queries at the application layer if custom code interacts with the database

bash

# Example: Disable GraphQL in Craft CMS config/general.php
# Add or modify the following configuration
'enableGql' => false,

# Alternative: Restrict GraphQL to authenticated users only
# In config/general.php
'enableGql' => true,
'enableGraphqlIntrospection' => false,