Is CVE-2023-22477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-22477 being exploited in the wild.

How severe is CVE-2023-22477?

Low severity, with a CVSS score of 3.1, published 9 January 2023.

Which products and versions are affected?

mercurius (npm) SEMVER:introduced=9.0.0,fixed=11.5.0.

Is there a fix for CVE-2023-22477?

Yes. mercurius (npm): upgrade to 11.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-22477 attacked?

It is attacked over the network.

Am I affected by CVE-2023-22477?

Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-22477: mercurius uncaught exception in subscriptions

CVE-2023-22477 · Severity: low · CVSS 3.1 · Published 2023-01-09

Mercurius is a GraphQL server library for Node.js that provides real-time subscriptions over WebSocket. An attacker can cause the service to crash by sending a malformed WebSocket packet to the GraphQL endpoint, resulting in an uncaught exception that terminates the application and causes denial of service.

Technologies: mercurius (npm). Vendors: npm.

Quick answers

Is CVE-2023-22477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-22477 being exploited in the wild.
How severe is CVE-2023-22477?: Low severity, with a CVSS score of 3.1, published 9 January 2023.
Which products and versions are affected?: mercurius (npm) SEMVER:introduced=9.0.0,fixed=11.5.0.
Is there a fix for CVE-2023-22477?: Yes. mercurius (npm): upgrade to 11.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-22477 attacked?: It is attacked over the network.
Am I affected by CVE-2023-22477?: Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mercurius (npm): upgrade to 11.5.0 or later
```
npm install mercurius@11.5.0
```

Technical details

This vulnerability is caused by an uncaught exception (CWE-248) when processing malformed WebSocket packets sent to the /graphql subscription endpoint. The attack requires no authentication or user interaction and is triggered by sending a crafted packet over the network via WebSocket. Any user running Mercurius versions 9.0.0 through 11.4.x or versions prior to 8.13.2 is vulnerable to having their GraphQL service crash. The vulnerability was patched in v11.5.0 and v8.13.2, with the fix properly handling and validating incoming subscription packets to prevent exception propagation.

Affected products

Mercurius mercurius <8.13.2, >=9.0.0, <11.5.0

Identifiers

CVE-2023-22477
GHSA-cm8h-q92v-xcfc

Timeline

2023-01-09: disclosed: Vulnerability published publicly
2023-01-09: patched: Patched in v11.5.0 and v8.13.2

References

https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.