PT-2023-31628 · Grackle+1 · Grackle+1
Armanbilge
·
Published
2023-12-18
·
Updated
2024-01-08
·
CVE-2023-50730
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Grackle versions prior to 0.18.0
Description
The issue arises from two stack overflow vulnerabilities in Grackle, a GraphQL server written in functional Scala. The first vulnerability occurs because Grackle did not check for cyclic fragments in GraphQL queries prior to version 0.18.0, which could lead to a JVM
StackOverflowError during type checking and compilation. The second vulnerability is due to the use of the recursive operator from the cats-parse library, which is not stack safe. This operator was used in three places in the parser, allowing queries with deeply nested selection sets, input values, or list types to cause a JVM StackOverflowException during parsing. Both issues can be exploited to cause a denial of service, potentially affecting all applications using Grackle with untrusted users.Recommendations
For Grackle versions prior to 0.18.0, update to version 0.18.0 to resolve the stack overflow issues.
As a temporary workaround, consider interposing a sanitizing layer between untrusted input and Grackle query processing to minimize the risk of exploitation.
Exploit
Fix
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Grackle
Cats-Parse