PT-2020-21539 · Apollo · Apollo-Server-Core+11

Published 2020-06-05 · Updated 2020-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apollo Server versions prior to 2.14.2 apollo-server-core versions prior to 2.14.2 apollo-server-express versions prior to 2.14.2 apollo-server-azure-functions versions prior to 2.14.2 apollo-server-cache-memcached versions prior to 2.14.2 apollo-server-cloud-functions versions prior to 2.14.2 apollo-server-cloudflare versions prior to 2.14.2 apollo-server-fastify versions prior to 2.14.2 apollo-server-hapi versions prior to 2.14.2 apollo-server-koa versions prior to 2.14.2 apollo-server-lambda versions prior to 2.14.2 apollo-server-micro versions prior to 2.14.2

Description The issue affects Apollo Server when subscriptions: false is not explicitly passed to the constructor options, allowing for potential introspection on the WebSocket subscriptions transport even if introspection is disabled on the HTTP transport. The severity of the risk depends on whether sensitive information is stored in the schema itself. The contents of schema descriptions or secrets revealed by type or field names determine the risk. User-provided validation rules using validationRules are not enforced on the WebSocket subscriptions transport.

Recommendations To resolve the issue, update Apollo Server to version 2.14.2 or higher, ensuring both the affected integration package and the apollo-server-core package are updated to the patched versions. As a temporary workaround, consider disabling subscriptions by setting subscriptions: false in the ApolloServer constructor options to disable all subscriptions support and the WebSocket transport.

Related Identifiers

GHSA-W42G-7VFC-XF37

Affected Products

Apollo Server

Apollo-Server-Azure-Functions

Apollo-Server-Cache-Memcached

Apollo-Server-Cloud-Functions

Apollo-Server-Cloudflare

Apollo-Server-Core

Apollo-Server-Express

Apollo-Server-Fastify

Apollo-Server-Hapi

Apollo-Server-Koa

Apollo-Server-Lambda

Apollo-Server-Micro

References · 16

• https://osv.dev/vulnerability/GHSA-w42g-7vfc-xf37 · Vendor Advisory
• https://github.com/apollographql/apollo-server/commit/e2e816316f5c28a03de2ee1589edb2b10c358114 · Note
• https://github.com/apollographql/apollo-server/security/advisories/GHSA-w42g-7vfc-xf37 · Note
• https://npmjs.com/advisories/1525 · Note
• https://npmjs.com/advisories/1536 · Note
• https://npmjs.com/advisories/1530 · Note
• https://npmjs.com/advisories/1532 · Note
• https://npmjs.com/advisories/1533 · Note
• https://npmjs.com/advisories/1534 · Note
• https://npmjs.com/advisories/1531 · Note
• https://npmjs.com/advisories/1527 · Note
• https://npmjs.com/advisories/1535 · Note
• https://npmjs.com/advisories/1529 · Note
• https://npmjs.com/advisories/1526 · Note
• https://github.com/advisories/GHSA-w42g-7vfc-xf37 · Note