Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 16 June 2023.

Which products and versions are affected?

apollo-server (npm) SEMVER:introduced=4.7.1,fixed=4.7.4.

Is there a fix for This vulnerability?

Yes. apollo-server (npm): upgrade to 4.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Apollo apollo-server improper CSP via nonce reuse

Severity: info · Published 2023-06-16

Apollo Server provides web-based landing pages for GraphQL developers. The Content Security Policy (CSP) protecting these pages reused the same cryptographic nonce for the lifetime of the server instance rather than generating a unique nonce per request, weakening the defense against cross-site scripting (XSS) attacks. While no active XSS vulnerabilities are known, this configuration fails to provide the intended security protection if any unpatched XSS vectors exist in the landing pages.

Technologies: apollo-server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 16 June 2023.
Which products and versions are affected?: apollo-server (npm) SEMVER:introduced=4.7.1,fixed=4.7.4.
Is there a fix for This vulnerability?: Yes. apollo-server (npm): upgrade to 4.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apollo-server (npm): upgrade to 4.7.4 or later
```
npm install apollo-server@4.7.4
```

Technical details

Apollo Server versions 4.7.1 through 4.7.3 implemented Content Security Policy on landing pages but violated CSP best practices by reusing a single static nonce across multiple requests. CSP nonces must be unique per request to prevent attackers from predicting and bypassing the policy; reuse of nonces (CWE-323) degrades this defense-in-depth mechanism. The vulnerability affects only the landing pages served by Apollo Server, is exploitable only if a separate XSS vector exists in those pages, and requires no authentication or special network positioning. The issue is patched in version 4.7.4 with proper per-request nonce generation and support for disabling dynamic styling via a new configuration option.

Affected products

Apollo apollo-server 4.7.1-4.7.3

Timeline

2023-06-16: disclosed: Advisory published
2023-06-15: patched: Fix merged in version 4.7.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.