2022-03-15 13:13:35 +00:00
id : graphql-alias-batching
info :
name : GraphQL Alias-based Batching
author : Dolev Farhi
2022-07-26 05:17:13 +00:00
severity : info
2022-03-15 13:13:35 +00:00
description : |
GraphQL supports aliasing of multiple sub-queries into a single queries. This allows users to request multiple objects or multiple instances of objects efficiently.
However, an attacker can leverage this feature to evade many security measures, including rate limit.
2023-10-14 11:27:55 +00:00
remediation : |
Limit queries aliasing in your GraphQL Engine to ensure mitigation of aliasing-based attacks.
2022-03-15 13:13:35 +00:00
reference :
- https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application
- https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html
- https://graphql.security/
- https://stackoverflow.com/questions/62421352/graphql-difference-between-using-alias-versus-multiple-query-objects-when-doin
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-10-14 11:27:55 +00:00
tags : graphql,misconfig
2023-07-20 07:43:09 +00:00
variables :
str : "{{to_lower(rand_text_alpha(5))}}"
2023-04-27 04:28:59 +00:00
http :
2022-03-15 13:13:35 +00:00
- raw :
- |
POST /graphql HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
2023-07-20 07:43:09 +00:00
{"query" : "query {\n {{str}}1:__typename \n {{str}}2:__typename \n {{str}}3:__typename \n {{str}}4:__typename \n {{str}}5:__typename \n {{str}}6:__typename \n }" }
2022-07-26 05:18:24 +00:00
- |
POST /api/graphql HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
2023-07-20 07:43:09 +00:00
{"query" : "query {\n {{str}}1:__typename \n {{str}}2:__typename \n {{str}}3:__typename \n {{str}}4:__typename \n {{str}}5:__typename \n {{str}}6:__typename \n }" }
2022-07-26 05:18:24 +00:00
2022-07-26 05:20:29 +00:00
stop-at-first-match : true
2023-10-14 11:27:55 +00:00
2022-03-15 13:13:35 +00:00
matchers-condition : and
matchers :
- type : word
part : body
words :
- '"data":'
2023-07-20 07:43:09 +00:00
- '"{{str}}1":'
- '"{{str}}6":'
2022-03-15 13:13:35 +00:00
condition : and
- type : word
part : header
words :
2023-10-14 11:27:55 +00:00
- "application/json"
2023-10-19 13:13:52 +00:00
# digest: 4a0a0047304502210081196c1edfbd4e6eb89d81c538dde50686f8d70d87c9e86dc0b01c9cf6c7a0ed02204c1cc4f188467d4c393e8ab37dd8071df0ac829c4c2eb1beccc843a0cccd688c:922c64590222798bb761d5b6d8e72950