Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0yZnZ2LXF4cnEtN2pxNs4AAuFi
apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page
Impact
The default landing page contained HTML to display a sample curl
command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from window.location.href
. On some older browsers such as IE11, this value is not URI-encoded. On such browsers, opening a malicious URL pointing at an Apollo Router could cause execution of attacker-controlled JavaScript.
This only affects Apollo Server with the default landing page enabled. Old browsers visiting your server may be affected if ANY of these apply:
- You do not pass any landing page plugin to the
plugins
option ofnew ApolloServer
. - You pass
ApolloServerPluginLandingPageLocalDefault()
orApolloServerPluginLandingPageProductionDefault()
to theplugins
option ofnew ApolloServer
.
Browsers visiting your server are NOT affected if ANY of these apply:
- You pass
ApolloServerPluginLandingPageDisabled()
to theplugins
option ofnew ApolloServer
. - You pass
ApolloServerPluginLandingPageGraphQLPlayground()
to theplugins
option ofnew ApolloServer
. - You pass a custom plugin implementing the
renderLandingPage
hook to theplugins
option ofnew ApolloServer
.
This issue was introduced in v3.0.0 when the landing page feature was added.
Patches
To avoid this, the sample curl
command has been removed in release 3.10.1.
Workarounds
Disabling the landing page removes the possibility of exploit:
import { ApolloServerPluginLandingPageDisabled } from 'apollo-server-core';
new ApolloServer({
plugins: [ApolloServerPluginLandingPageDisabled()],
// ...
});
See also
A similar issue exists in the landing page of Apollo Router. See the corresponding Apollo Router security advisory.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Apollo Server repository
- Email us at [email protected]
Credits
This issue was discovered by Adrian Denkiewicz of Doyensec.
Permalink: https://github.com/advisories/GHSA-2fvv-qxrq-7jq6JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yZnZ2LXF4cnEtN2pxNs4AAuFi
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: over 1 year ago
Identifiers: GHSA-2fvv-qxrq-7jq6
References:
- https://github.com/apollographql/apollo-server/security/advisories/GHSA-2fvv-qxrq-7jq6
- https://github.com/apollographql/apollo-server/commit/68a439b6e3af9edc8a2480092f2d49f058be1e64
- https://github.com/advisories/GHSA-2fvv-qxrq-7jq6
Blast Radius: 0.0
Affected Packages
npm:apollo-server-core
Dependent packages: 531Dependent repositories: 76,434
Downloads: 4,880,913 last month
Affected Version Ranges: >= 3.0.0, < 3.10.1
Fixed in: 3.10.1
All affected versions: 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.7.0, 3.8.0, 3.8.1, 3.8.2, 3.9.0, 3.10.0
All unaffected versions: 1.0.2, 1.1.0, 1.1.3, 1.1.5, 1.1.6, 1.1.7, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.4.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.6, 2.4.7, 2.4.8, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.7.0, 2.7.1, 2.7.2, 2.8.0, 2.8.1, 2.8.2, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 2.9.14, 2.9.15, 2.9.16, 2.10.0, 2.10.1, 2.11.0, 2.12.0, 2.13.0, 2.13.1, 2.14.0, 2.14.1, 2.14.2, 2.14.3, 2.14.4, 2.14.5, 2.15.0, 2.15.1, 2.16.0, 2.16.1, 2.17.0, 2.18.0, 2.18.1, 2.18.2, 2.19.0, 2.19.1, 2.19.2, 2.20.0, 2.21.0, 2.21.1, 2.21.2, 2.22.0, 2.22.1, 2.22.2, 2.23.0, 2.24.0, 2.24.1, 2.25.0, 2.25.1, 2.25.2, 2.25.3, 2.25.4, 2.26.0, 2.26.1, 2.26.2, 3.10.1, 3.10.2, 3.10.3, 3.10.4, 3.11.0, 3.11.1, 3.12.0, 3.12.1, 3.13.0