Executive brief
Apollo Server provides web-based landing pages for GraphQL developers. The Content Security Policy (CSP) protecting these pages reused the same cryptographic nonce for the lifetime of the server instance rather than generating a unique nonce per request, weakening the defense against cross-site scripting (XSS) attacks. While no active XSS vulnerabilities are known, this configuration fails to provide the intended security protection if any unpatched XSS vectors exist in the landing pages.
Technical details
Apollo Server versions 4.7.1 through 4.7.3 implemented Content Security Policy on landing pages but violated CSP best practices by reusing a single static nonce across multiple requests. CSP nonces must be unique per request to prevent attackers from predicting and bypassing the policy; reuse of nonces (CWE-323) degrades this defense-in-depth mechanism. The vulnerability affects only the landing pages served by Apollo Server, is exploitable only if a separate XSS vector exists in those pages, and requires no authentication or special network positioning. The issue is patched in version 4.7.4 with proper per-request nonce generation and support for disabling dynamic styling via a new configuration option.
Affected products
- Apollo apollo-server 4.7.1-4.7.3
Timeline
- 2023-06-16: disclosed: Advisory published
- 2023-06-15: patched: Fix merged in version 4.7.4