Executive brief
Apollo Server 2, a popular tool for building data interfaces (APIs), contains a security flaw in its file upload component. This flaw allows an attacker to trick a user's browser into performing unauthorized actions on the server, such as modifying data, without the user's knowledge. This occurs because the server processes certain types of web requests that bypass standard browser security checks.
Technical details
Apollo Server 2 bundles the 'graphql-upload' library and enables it by default. This library processes 'multipart/form-data' POST requests, which are classified as 'simple requests' by browsers and thus bypass CORS preflight checks. If a server uses cookie-based authentication with 'SameSite=None' or relies on network-level security (like a private IP), an attacker can craft a malicious website that triggers authenticated GraphQL mutations on the victim's server. While the attacker cannot see the response due to CORS, the side effects of the mutation (data modification) are executed. The vulnerability is mitigated in version 2.25.4 by disabling the upload middleware if it is not explicitly used in the schema, though full CSRF protection requires upgrading to Apollo Server 3.7+.
Affected products
- Apollo GraphQL apollo-server 2.0.0 - 2.25.3
Timeline
- 2022-05-25: patched: Fix committed to Apollo Server 2 branch
- 2022-10-12: advisory: GitHub Security Advisory published