PT-2023-33035 · Unknown · Apollo Server

Published 2023-08-30 · Updated 2023-08-30

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apollo Server versions prior to the latest version

Description The issue concerns Apollo Server logging sensitive information, specifically Studio API keys, under certain conditions. This occurs when API keys are passed with leading or trailing whitespace or contain invalid characters for header values. Users are impacted if they utilize either schema reporting or usage reporting features, have an Apollo Studio API key with invalid header values, and use the default fetcher (node-fetch) or a configured node-fetch fetcher. The problem can lead to errors being logged, potentially exposing the API key.

Recommendations For Apollo Server versions prior to the latest version: Update to the latest version of Apollo Server, which includes patches for this issue. As a temporary workaround, consider retrieving a new API key from Studio, overriding the fetcher, or disabling schema reporting and/or usage reporting to minimize the risk of exploitation.

Related Identifiers

GHSA-J5G3-5C8R-7QFX

Affected Products

Apollo Server

References · 5

• https://osv.dev/vulnerability/GHSA-j5g3-5c8r-7qfx · Vendor Advisory
• https://github.com/apollographql/apollo-server · Note
• https://github.com/apollographql/apollo-server/commit/2c8106c433c4add4b43e2e2b2f5c5c4887b17314 · Note
• https://github.com/apollographql/apollo-server/commit/d38b43bac88acdef4295759d7dcc3d4c348d9575 · Note
• https://github.com/apollographql/apollo-server/security/advisories/GHSA-j5g3-5c8r-7qfx · Note