Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, with a CVSS score of 6.1, published 8 November 2021.

Which products and versions are affected?

apollo-server (npm) SEMVER:introduced=2.0.0,fixed=2.25.3.

Is there a fix for This vulnerability?

Yes. apollo-server (npm): upgrade to 2.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Apollo Server cross-site scripting in GraphQL Playground

Severity: info · CVSS 6.1 · Published 2021-11-08

Apollo Server is a GraphQL framework that can serve GraphQL Playground, a web-based interface for querying APIs. A cross-site scripting vulnerability in GraphQL Playground allows attackers to execute arbitrary JavaScript code in the context of the server's origin. If a user clicks a malicious link, an attacker can steal authentication cookies and other sensitive browser data stored for that server.

Technologies: apollo-server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, with a CVSS score of 6.1, published 8 November 2021.
Which products and versions are affected?: apollo-server (npm) SEMVER:introduced=2.0.0,fixed=2.25.3.
Is there a fix for This vulnerability?: Yes. apollo-server (npm): upgrade to 2.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apollo-server (npm): upgrade to 2.25.3 or later
```
npm install apollo-server@2.25.3
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the GraphQL Playground web application served by Apollo Server in certain configurations. The root cause is in the GraphQL Playground component itself, which Apollo Server distributes. Apollo Server 2 serves GraphQL Playground by default (unless NODE_ENV is set to production), while Apollo Server 3 requires explicit opt-in. An attacker crafts a malicious URL to the GraphQL Playground page that injects arbitrary JavaScript; when a user clicks this link, the payload executes in the browser with access to cookies and credentials for the server's origin. The vulnerability is patched in Apollo Server 2.25.3 and 3.4.1; workarounds include upgrading the bundled GraphQL Playground version or disabling GraphQL Playground entirely.

Affected products

Apollo Apollo Server 2.0.0–2.25.2, 3.0.0–3.4.0
Apollo Apollo Server Express 2.0.0–2.25.2, 3.0.0–3.4.0
Apollo Apollo Server Lambda 2.0.0–2.25.2, 3.0.0–3.4.0

Timeline

2021-11-04: disclosed: Vulnerability advisory published
2021-11-08: patched: Patches released: Apollo Server 2.25.3 and 3.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.