Executive brief
Apollo Server is a GraphQL runtime that processes client requests and sends responses. When clients send multiple GraphQL operations in a single batched HTTP request, the server may return an incorrect cache-control header that reflects the policy of only one operation instead of all operations. This could cause sensitive or session-specific data to be cached and shared inappropriately in CDNs or reverse proxies, potentially exposing one user's data to other users.
Technical details
The vulnerability is an incorrect cache-control header generation (CWE-524) that occurs when Apollo Server processes batched HTTP requests containing multiple GraphQL operations with differing cache policies. In Apollo Server 3 and 4, the response header merging logic arbitrarily selects one operation's cache-control value when multiple operations specify different policies. An attacker can craft a batched POST request combining an operation that should not be cached (containing session-specific data) with an operation that can be cached, resulting in a response header that permits caching the entire response. If the reverse proxy or CDN respects POST request caching, the cached response will include the session-specific data, causing cache poisoning. The vulnerability requires specific server configuration allowing POST caching and does not affect most browser or mobile client caches. Patches are available: Apollo Server 3.11.0+ disables cache-control headers on batched requests entirely; Apollo Server 4.1.0+ implements header merging across all operations.
Affected products
- Apollo apollo-server-core 3.0.0 to 3.10.x
- Apollo apollo-server 3.0.0 to 3.10.x
- Apollo apollo-server-express 3.0.0 to 3.10.x
- Apollo @apollo/server before 4.1.0
Timeline
- 2022-11-02: disclosed: Advisory GHSA-8r69-3cvp-wxc3 published
- 2022-11-02: patched: Apollo Server 3.11.0 and 4.1.0 released with fixes