PT-2019-20019 · Apollo · Apollo Gateway

Published 2019-06-13 · Updated 2019-06-13

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions @apollo/gateway versions prior to 0.6.2

Description The issue allows attackers to alter the Object prototype through queries with GraphQL aliases, potentially leading to Denial of Service or Remote Code Execution when chained with other vulnerabilities. This is due to the use of deepMerge() to merge objects, which can be exploited with carefully constructed payloads to override properties of all objects in the application.

Recommendations Upgrade to version 0.6.2 or later.

Fix

Prototype Pollution

Resource Exhaustion

Weakness Enumeration

CWE-1321

CWE-400

Related Identifiers

GHSA-74CR-77XC-8G6R

Affected Products

Apollo Gateway

References · 5

• https://osv.dev/vulnerability/GHSA-74cr-77xc-8g6r · Vendor Advisory
• https://github.com/apollographql/apollo-server/commit/cea7397582a293af6a5f60947da34b95e669c6c1 · Note
• https://github.com/apollographql/apollo-server/pull/2779 · Note
• https://snyk.io/vuln/SNYK-JS-APOLLOGATEWAY-174915 · Note
• https://npmjs.com/advisories/917 · Note