Executive brief
type-graphql is a popular GraphQL framework for TypeScript that helps developers build GraphQL APIs. The framework inadvertently leaks sensitive resolver source code in error messages when subscription requests are malformed, potentially exposing implementation details that attackers could use to identify vulnerabilities or understand system architecture.
Technical details
The vulnerability is an information exposure issue (CWE-209) in type-graphql prior to version 0.17.6. The MissingSubscriptionTopicsError class improperly constructs error messages by concatenating the target object directly instead of using a property like target.name, which causes the entire resolver function source code to be leaked in the error response. An attacker can trigger this error by sending a subscription request without providing required topics, and the resulting error message will contain the full source code of the affected resolver, revealing implementation logic and potential attack surface. This is a local/network-accessible information leak with no authentication required. The fix was released in version 0.17.6.
Affected products
- MichalLytek type-graphql prior to 0.17.6
Timeline
- 2019-12-12: disclosed
- 2020-08-31: patched: version 0.17.6 released