Executive brief
graphql-shield is a library used to add authorization rules to GraphQL APIs. The no_cache rule caching option uses weak cryptographic functions to generate cache keys, allowing attackers to cause cache collisions and bypass authorization checks to access data they should not have access to.
Technical details
The vulnerability is an authorization bypass (CWE-285) in graphql-shield versions before 6.0.6. The no_cache rule caching mechanism relies on cryptographically insecure key generation functions, making cache keys predictable and subject to collision attacks. An attacker can craft requests that collide with cached rule results for other users, bypassing authorization checks. The vulnerability requires the no_cache option to be enabled in the rule configuration. The fix is available in version 6.0.6 and later.
Affected products
- graphql-shield graphql-shield before 6.0.6
Timeline
- 2020-09-03: disclosed