High, CVSS 7.1npmAmendedPublished
GraphiQL introspection schema template injection attack
CVE-2021-41248 · GHSA-x4r7-m2q9-69c8
- Affected
- npm graphiql >= 0.5.0, < 1.4.7
- Fixed in
- 1.4.7· Vendor fix available
- Issue
- - 1. Impact - 2. Scope - 3. Patches - 3.1 CDN bundle implementations may be automatically patched - 4. Workarounds for Older Versions - 5. How to Re-create the Exploit - 6. Credit - 7. References - 8. For more information This is a security advisory for an XSS vulnerability in graphiql. A similar vulnerability affects graphql-playground, a fork of graphiql. There is a corresponding graphql-playground advisory and Apollo Server advisory. 1. Impact All versions of graphiql older than graphiql@1.4.7 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a vulnerable schema in graphiql. There are a number of ways that can occur. By default, the schema URL is not attacker-controllable in graphiql or in its suggested implementations or examples, leaving only very complex…
Recommended action: Upgrade to 1.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.