Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, with a CVSS score of 5.4, published 12 October 2022.

Which products and versions are affected?

apollo-server (npm) SEMVER:introduced=2.0.0,fixed=2.25.4.

Is there a fix for This vulnerability?

Yes. apollo-server (npm): upgrade to 2.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Apollo Server CSRF mutation in graphql-upload library

Severity: info · CVSS 5.4 · Published 2022-10-12

Apollo Server 2, a popular tool for building data interfaces (APIs), contains a security flaw in its file upload component. This flaw allows an attacker to trick a user's browser into performing unauthorized actions on the server, such as modifying data, without the user's knowledge. This occurs because the server processes certain types of web requests that bypass standard browser security checks.

Technologies: apollo-server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, with a CVSS score of 5.4, published 12 October 2022.
Which products and versions are affected?: apollo-server (npm) SEMVER:introduced=2.0.0,fixed=2.25.4.
Is there a fix for This vulnerability?: Yes. apollo-server (npm): upgrade to 2.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apollo-server (npm): upgrade to 2.25.4 or later
```
npm install apollo-server@2.25.4
```

Technical details

Apollo Server 2 bundles the 'graphql-upload' library and enables it by default. This library processes 'multipart/form-data' POST requests, which are classified as 'simple requests' by browsers and thus bypass CORS preflight checks. If a server uses cookie-based authentication with 'SameSite=None' or relies on network-level security (like a private IP), an attacker can craft a malicious website that triggers authenticated GraphQL mutations on the victim's server. While the attacker cannot see the response due to CORS, the side effects of the mutation (data modification) are executed. The vulnerability is mitigated in version 2.25.4 by disabling the upload middleware if it is not explicitly used in the schema, though full CSRF protection requires upgrading to Apollo Server 3.7+.

Affected products

Apollo GraphQL apollo-server 2.0.0 - 2.25.3

Timeline

2022-05-25: patched: Fix committed to Apollo Server 2 branch
2022-10-12: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.