PT-2021-23212 · Graphql+1 · Graphql+2

Ry0Tak · Published 2021-11-04 · Updated 2024-11-08 · CVE-2021-41248

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions graphiql versions prior to 1.4.7 graphql-playground-react versions prior to 1.7.28

Description The vulnerability allows for compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a vulnerable schema in graphiql or graphql-playground. By default, the schema URL is not attacker-controllable, leaving only very complex attack vectors. However, if a custom implementation allows the schema URL to be set dynamically, it becomes vulnerable to phishing attacks and low or no privilege level XSS attacks. The vulnerability affects all forks of graphiql and every released version of graphiql, but does not impact codemirror-graphql, monaco-graphql, or other dependents.

Recommendations

• For graphiql versions prior to 1.4.7, upgrade to version 1.4.7 or later.
• For graphql-playground-react versions prior to 1.7.28, upgrade to version 1.7.28 or later.
• If you are using graphql-playground-html or a package which starts with graphql-playground-middleware- in your server and you are passing the version option to a function imported from that package, change that version option to be at least "1.7.28".
• If you are using graphql-playground-html or a package which starts with graphql-playground-middleware- in your server and you are NOT passing the version option to a function imported from that package, no action is necessary; your app automatically loads the latest version of graphql-playground-react from CDN.
• Always use a static URL to a trusted server that is serving a trusted GraphQL schema.
• If you have a custom implementation that allows using user-provided schema URLs via a query parameter, database value, etc, you must either disable this customization, or only allow trusted URLs.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41248

GHSA-59R9-6JP6-JCM7

GHSA-X4R7-M2Q9-69C8

Affected Products

Graphql

Graphql-Playground-Html

Graphql-Playground-React

References · 16

• https://github.com/graphql/graphiql/commit/cb237eeeaf7333c4954c752122261db7520f7bf4 · Patch
• https://osv.dev/vulnerability/GHSA-x4r7-m2q9-69c8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41248 · Security Note
• https://osv.dev/vulnerability/GHSA-59r9-6jp6-jcm7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41249 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41248 · Vendor Advisory
• https://github.com/graphql/graphiql/security/advisories/GHSA-x4r7-m2q9-69c8 · Note
• https://github.com/graphql/graphiql/blob/main/docs/security/2021-introspection-schema-xss.md#2-more-details-on-the-vulnerability · Note
• https://github.com/graphql/graphiql/commit/b9dec272d89d9c590727fd10d62e4a47e0317fc7#diff-855b77f6310b7e4fb1bcac779cd945092ed49fd759f4684ea391b45101166437R87 · Note
• https://github.com/graphql/graphiql/commit/6701b0b626e43800e32413590a295e5c1e3d5419#diff-d45eb76aebcffd27d3a123214487116fa95e0b5a11d70a94a0ce3033ce09f879R110 · Note
• https://github.com/graphql/graphiql · Note
• https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7 · Note
• https://github.com/graphql/graphql-playground/commit/b8a956006835992f12c46b90384a79ab82bcadad · Note
• https://github.com/graphql/graphql-playground · Note
• https://t.me/cibsecurity/31859 · Telegram Post