CVE-2023-26052

Unhandled Python Exceptions in Saleor GraphQL API

• CVSS 5.3
• CWE-209 Generation of Error Message Containing Sensitive Information
• Information Leakage
• Remote

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.

CVE

CVE-2023-26052

CWE

CWE-209 Generation of Error Message Containing Sensitive Information

CVSS base score

5.3

Published

2023-03-02

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Saleor to version 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14, or 3.11.12 to fix the vulnerability.

def some_graphql_resolver():
    try:
        raise ValueError("This is a sensitive error message that should not be exposed.")
    except Exception as e:
        return {
            "errors": [
                {
                    "message": str(e)
                }
            ]
        }

import logging

logging.basicConfig(level=logging.ERROR)

def handle_graphql_error(error):
    logging.error(f"GraphQL error occurred: {error}")

    return {
        "errors": [
            {
                "message": "An internal error occurred. Please try again later."
            }
        ]
    }

def some_graphql_resolver():
    try:
        raise ValueError("This is a sensitive error message that should not be exposed.")
    except Exception as e:
        return handle_graphql_error(e)

@misc{vaitp:cve202326052,
  title        = {{Unhandled Python Exceptions in Saleor GraphQL API}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-26052},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-26052/}}
}