Executive brief
Apollo Gateway is a component that helps federate multiple GraphQL services. Versions before 0.6.2 contain a flaw in its object-merging logic that allows attackers to craft malicious GraphQL queries that corrupt the behavior of all objects in the application, potentially causing service outages or enabling further attacks.
Technical details
The vulnerability is a prototype pollution flaw in the deepMerge() utility function used by @apollo/gateway. The function failed to filter the __proto__ property when merging objects, allowing attackers to inject payloads through GraphQL aliases that modify Object.prototype. This affects all versions prior to 0.6.2. The attack is network-reachable and requires no authentication. An attacker can manipulate application state to cause denial of service or potentially chain the vulnerability with other issues to achieve remote code execution. The fix, released in version 0.6.2, adds filtering to ignore __proto__ fields during the merge operation.
Affected products
- Apollo @apollo/gateway before 0.6.2
Timeline
- 2019-06-13: disclosed
- 2019-06-04: patched: PR #2779 merged; version 0.6.2 released shortly after