CVE-2023-40027: Conditionally missing authorization in @keystone-6/core
Summary When ui.isAccessAllowed is undefined, the adminMeta GraphQL query is publicly accessible, that is to say, no session is required for the query.
This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible if a session strategy is not defined.
Impact This vulnerability does not affect developers using the @keystone-6/auth package, or any users that have written their own ui.isAccessAllowed (that is to say, you are unaffected if ui.isAccessAllowed is defined).
This vulnerability does affect developers who thought that their session strategy will, by default, enforce that adminMeta is inaccessible by the public in accordance with that strategy; akin to the behaviour of the AdminUI middleware.
Patches This vulnerability has been patched in @keystone-6/core version 5.5.1.
Workarounds You can opt to write your own isAccessAllowed to work-around this vulnerability.
References Pull request https://github.com/keystonejs/keystone/pull/8771
Other sources
Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible (no session required) if a session strategy is not defined. This vulnerability does not affect developers using the @keystone-6/auth package, or any users that have written their own ui.isAccessAllowed (that is to say, isAccessAllowed is not undefined). This vulnerability does affect users who believed that their session strategy will, by default, enforce that adminMeta is inaccessible by the public in accordance with that strategy; akin to the behaviour of the AdminUI middleware. This vulnerability has been patched in @keystone-6/core version 5.5.1. Users are advised to upgrade. Users unable to upgrade may opt to write their own isAccessAllowed functionality to work-around this vulnerability.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40027?
CVE-2023-40027 has been rated as a moderate severity vulnerability.
How do I fix CVE-2023-40027?
To fix CVE-2023-40027, ensure that the `ui.isAccessAllowed` function is correctly defined to restrict access to the `adminMeta` GraphQL query.
What are the effects of CVE-2023-40027?
CVE-2023-40027 allows unauthorized access to sensitive metadata through the `adminMeta` GraphQL query due to insufficient session checks.
Which versions of Keystone are affected by CVE-2023-40027?
CVE-2023-40027 affects Keystone versions prior to 5.5.1.
Is there a patch available for CVE-2023-40027?
Yes, a patch for CVE-2023-40027 is available in the updated versions of Keystone.