PT-2021-23213 · Graphql+1 · Graphql+2

Ry0Tak · Published 2021-11-04 · Updated 2021-11-09 · CVE-2021-41249

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions graphql-playground-react versions prior to 1.7.28 graphiql versions prior to 1.4.7

Description The vulnerability allows for compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. This can occur when a user loads a malicious schema in graphql-playground or graphiql, potentially through specifying a URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground or graphiql installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals.

Recommendations If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later. If you are using graphql-playground-html or a package which starts with graphql-playground-middleware- in your server and you are passing the version option to a function imported from that package, change that version option to be at least "1.7.28". If you are using graphql-playground-html or a package which starts with graphql-playground-middleware- in your server and you are NOT passing the version option to a function imported from that package, no action is necessary; your app automatically loads the latest version of graphql-playground-react from CDN. If you are using graphiql, upgrade to version 1.4.7 or later. Always use a static URL to a trusted server that is serving a trusted GraphQL schema. If you have a custom implementation that allows using user-provided schema URLs via a query parameter, database value, etc, you must either disable this customization, or only allow trusted URLs.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41249

GHSA-59R9-6JP6-JCM7

GHSA-X4R7-M2Q9-69C8

Affected Products

Graphql

Graphql-Playground-Html

Graphql-Playground-React

References · 15

• https://github.com/graphql/graphql-playground/commit/b8a956006835992f12c46b90384a79ab82bcadad · Patch
• https://osv.dev/vulnerability/GHSA-x4r7-m2q9-69c8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59r9-6jp6-jcm7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41249 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41248 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41249 · Vendor Advisory
• https://github.com/graphql/graphiql/security/advisories/GHSA-x4r7-m2q9-69c8 · Note
• https://github.com/graphql/graphiql/commit/cb237eeeaf7333c4954c752122261db7520f7bf4 · Note
• https://github.com/graphql/graphiql/blob/main/docs/security/2021-introspection-schema-xss.md#2-more-details-on-the-vulnerability · Note
• https://github.com/graphql/graphiql/commit/b9dec272d89d9c590727fd10d62e4a47e0317fc7#diff-855b77f6310b7e4fb1bcac779cd945092ed49fd759f4684ea391b45101166437R87 · Note
• https://github.com/graphql/graphiql/commit/6701b0b626e43800e32413590a295e5c1e3d5419#diff-d45eb76aebcffd27d3a123214487116fa95e0b5a11d70a94a0ce3033ce09f879R110 · Note
• https://github.com/graphql/graphiql · Note
• https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7 · Note
• https://github.com/graphql/graphql-playground · Note
• https://t.me/cibsecurity/31857 · Telegram Post