PT-2019-20019 · Apollo · Apollo Gateway

Publicado 2019-06-13 · Atualizado 2019-06-13

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions @apollo/gateway versions prior to 0.6.2

Description The issue allows attackers to alter the Object prototype through queries with GraphQL aliases, potentially leading to Denial of Service or Remote Code Execution when chained with other vulnerabilities. This is due to the use of deepMerge() to merge objects, which can be exploited with carefully constructed payloads to override properties of all objects in the application.

Recommendations Upgrade to version 0.6.2 or later.

Correção

Prototype Pollution

Resource Exhaustion

Enumeração de Fraquezas

CWE-1321

CWE-400

Identificadores relacionados

GHSA-74CR-77XC-8G6R

Produtos afetados

Apollo Gateway

Referências · 5

• https://github.com/apollographql/apollo-server/commit/cea7397582a293af6a5f60947da34b95e669c6c1 · Nota
• https://github.com/apollographql/apollo-server/pull/2779 · Nota
• https://snyk.io/vuln/SNYK-JS-APOLLOGATEWAY-174915 · Nota
• https://osv.dev/vulnerability/GHSA-74cr-77xc-8g6r · Aviso do Fabricante
• https://npmjs.com/advisories/917 · Nota