id: graphql-array-batching

info:
  name: GraphQL Array-based Batching
  author: Dolev Farhi
  severity: info
  description: |
    Some GraphQL engines support batching of multiple queries into a single request. This allows users to request multiple objects or multiple instances of objects efficiently.
    However, an attacker can leverage this feature to evade many security measures, including Rate Limit.
  reference:
    - https://stackoverflow.com/questions/62421352/graphql-difference-between-using-alias-versus-multiple-query-objects-when-doin
    - https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application
    - https://graphql.security/
  remediation: |
    Deactivate or limit Batching in your GraphQL engine.
  tags: graphql

requests:
  - raw:
      - |
        POST /graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        [{"query":"query {\n __typename \n }"}, {"query":"mutation { \n __typename \n }"}]

      - |
        POST /api/graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        [{"query":"query {\n __typename \n }"}, {"query":"mutation { \n __typename \n }"}]

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ':"Query"'
          - ':"Mutations"'
        case-insensitive: true
        condition: and

      - type: word
        part: header
        words:
          - "application/json"