PT-2024-25018 · Apollo · Apollo Router

Xuorig · Published 2024-05-02 · Updated 2024-05-02 · CVE-2024-32971

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apollo Router versions 1.44.0 through 1.45.0

Description The issue stems from a bug in Apollo Router’s cache retrieval logic. When distributed query planning caching is enabled, asking the Router to execute an operation may result in an unexpected variation of that operation being executed or the generation of unexpected errors. This can lead to unintended data or effects, such as fetching incorrect results for a query or sending incorrect mutations to underlying subgraph servers. For example, rather than running fetchUsers(type: ENTERPRISE), the Router may run fetchUsers(type: TRIAL). For a mutation, this may result in incorrect mutations being sent to underlying subgraph servers, such as sending deleteUser(id: 12) instead of deleteUser(id: 10).

Recommendations To resolve the issue, upgrade to version 1.45.1 or above of the Apollo Router. As an alternative, downgrade to version 1.43.2 of the Apollo Router. If unable to upgrade or downgrade, disable distributed query plan caching by removing the supergraph.query planning.cache.redis.urls configuration to mitigate the issue.

Exploit

Fix

Weakness Enumeration

CWE-440

CWE-670

Related Identifiers

CVE-2024-32971

GHSA-Q9P4-HW9M-FJ2V

Affected Products

Apollo Router

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32971.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-32971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32971 · Security Note
• https://osv.dev/vulnerability/GHSA-q9p4-hw9m-fj2v · Vendor Advisory
• https://github.com/apollographql/router · Note
• https://github.com/apollographql/router/releases/tag/v1.45.1 · Note
• https://github.com/apollographql/router/security/advisories/GHSA-q9p4-hw9m-fj2v · Note
• https://github.com/apollographql/router/commit/ff9f666598cd17661880fe7fc6e9c9611316e529 · Note
• https://twitter.com/linuxpatch/status/1785958838132187415 · Twitter Post
• https://twitter.com/oktsec/status/1785950572190810383 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1785983458684080490 · Twitter Post
• https://t.me/pentestingnews/46514 · Telegram Post
• https://apollographql.com/docs/router/configuration/distributed-caching/#distributed-query-plan-caching · Note
• https://twitter.com/CVEnew/status/1785947317616644170 · Twitter Post
• https://twitter.com/vipr_lab/status/1786024850626126195 · Twitter Post