Executive brief
Apollo Server is a GraphQL framework that can serve GraphQL Playground, a web-based interface for querying APIs. A cross-site scripting vulnerability in GraphQL Playground allows attackers to execute arbitrary JavaScript code in the context of the server's origin. If a user clicks a malicious link, an attacker can steal authentication cookies and other sensitive browser data stored for that server.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the GraphQL Playground web application served by Apollo Server in certain configurations. The root cause is in the GraphQL Playground component itself, which Apollo Server distributes. Apollo Server 2 serves GraphQL Playground by default (unless NODE_ENV is set to production), while Apollo Server 3 requires explicit opt-in. An attacker crafts a malicious URL to the GraphQL Playground page that injects arbitrary JavaScript; when a user clicks this link, the payload executes in the browser with access to cookies and credentials for the server's origin. The vulnerability is patched in Apollo Server 2.25.3 and 3.4.1; workarounds include upgrading the bundled GraphQL Playground version or disabling GraphQL Playground entirely.
Affected products
- Apollo Apollo Server 2.0.0–2.25.2, 3.0.0–3.4.0
- Apollo Apollo Server Express 2.0.0–2.25.2, 3.0.0–3.4.0
- Apollo Apollo Server Lambda 2.0.0–2.25.2, 3.0.0–3.4.0
Timeline
- 2021-11-04: disclosed: Vulnerability advisory published
- 2021-11-08: patched: Patches released: Apollo Server 2.25.3 and 3.4.1