PT-2022-15055 · Unknown+1 · Graphql-Go+1

Jupenur · Published 2022-01-21 · Updated 2023-07-24 · CVE-2022-21708

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions graphql-go versions prior to 1.3.0

Description The issue is a DoS vulnerability due to a bug in the library that allows an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows, potentially compromising the server's ability to serve data. This issue only occurs when using the graphql.MaxDepth option in the schema.

Recommendations For versions prior to 1.3.0, the best workaround is to patch to a version greater than or equal to v1.3.0. Otherwise, the only workaround in versions prior to v1.3.0 is to disable the graphql.MaxDepth option from your schema, although this could potentially create opportunities for other attacks.

Exploit

Fix

DoS

Uncontrolled Recursion

Resource Exhaustion

Weakness Enumeration

CWE-674

CWE-400

Related Identifiers

CVE-2022-21708

GHSA-MH3M-8C74-74XH

GO-2022-0300

Affected Products

Debian

Graphql-Go

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21708.json · Exploit
• https://github.com/graph-gophers/graphql-go/commit/eae31ca73eb3473c544710955d1dbebc22605bfe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21708 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21708 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21708 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21708 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21708 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21708 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mh3m-8c74-74xh · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21708 · Security Note
• https://osv.dev/vulnerability/GO-2022-0300 · Vendor Advisory
• https://github.com/graph-gophers/graphql-go/security/advisories/GHSA-mh3m-8c74-74xh · Note
• https://github.com/graph-gophers/graphql-go/pull/492 · Note
• https://github.com/graph-gophers/graphql-go · Note
• https://t.me/cvenotify/55027 · Telegram Post