*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Apollo-server-core before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable names.
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.
NPM package apollo-server-core version 2.0.0 through 2.25.2, and 3.0.0 through 3.4.0 are imacted. Fixed in 2.25.3 and 3.4.1.
In certain configurations, Apollo Server serves the client-side web app "GraphQL Playground" from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations. There is a cross-site scripting vulnerability in GraphQL Playground that allows for arbitrary JavaScript code execution in your web server's origin. If a user clicks a specially crafted link to your GraphQL Playground page served by Apollo Server, an attacker can steal cookies and other private browser data.
Details of the underlying GraphQL Playground vulnerability are available in this graphql-playground advisory. (A similar vulnerability exists in the related graphiql project.) This advisory focuses on identifying whether Apollo Server installations are vulnerable and mitigating the vulnerability in Apollo Server; see the other advisories for details on the XSS vulnerability itself.
The impact of this vulnerability is more severe if (as is common) your GraphQL server's origin URL is an origin that is used to store sensitive data such as cookies.
In order for this vulnerability to affect your Apollo Server installation, it must actually serve GraphQL Playground. The integration between Apollo Server and GraphQL Playground is different in Apollo Server 2 and Apollo Server 3. You can tell which version of Apollo Server you are running by looking at the version of the package from which you import the ApolloServer class: this may be apollo-server, apollo-server-express, apollo-server-lambda, etc.
Apollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value.
Core engine for Apollo GraphQL server
Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.8.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/apollo-server-core/package.json
Found in HEAD commit: fc1df3b41be3f01efaf3bc1b191cb27d84c53f21
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
WS-2020-0108
### Vulnerable Library - apollo-server-core-2.8.1.tgzCore engine for Apollo GraphQL server
Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.8.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/apollo-server-core/package.json
Dependency Hierarchy: - :x: **apollo-server-core-2.8.1.tgz** (Vulnerable Library)
Found in HEAD commit: fc1df3b41be3f01efaf3bc1b191cb27d84c53f21
Found in base branch: main
### Vulnerability DetailsApollo-server-core before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable names.
Publish Date: 2020-06-05
URL: WS-2020-0108
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-w42g-7vfc-xf37
Release Date: 2020-06-05
Fix Resolution: 2.14.2
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-37890
### Vulnerable Library - ws-6.2.2.tgzSimple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-6.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ws/package.json
Dependency Hierarchy: - apollo-server-core-2.8.1.tgz (Root Library) - :x: **ws-6.2.2.tgz** (Vulnerable Library)
Found in HEAD commit: fc1df3b41be3f01efaf3bc1b191cb27d84c53f21
Found in base branch: main
### Vulnerability Detailsws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Publish Date: 2024-06-17
URL: CVE-2024-37890
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
Release Date: 2024-06-17
Fix Resolution (ws): 6.2.3
Direct dependency fix Resolution (apollo-server-core): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-24434
### Vulnerable Library - dicer-0.3.0.tgzA very fast streaming multipart parser for node.js
Library home page: https://registry.npmjs.org/dicer/-/dicer-0.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dicer/package.json
Dependency Hierarchy: - apollo-server-core-2.8.1.tgz (Root Library) - graphql-upload-8.1.0.tgz - busboy-0.3.1.tgz - :x: **dicer-0.3.0.tgz** (Vulnerable Library)
Found in HEAD commit: fc1df3b41be3f01efaf3bc1b191cb27d84c53f21
Found in base branch: main
### Vulnerability DetailsThis affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
Publish Date: 2022-05-20
URL: CVE-2022-24434
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.
CVE-2021-41249
### Vulnerable Library - apollo-server-core-2.8.1.tgzCore engine for Apollo GraphQL server
Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.8.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/apollo-server-core/package.json
Dependency Hierarchy: - :x: **apollo-server-core-2.8.1.tgz** (Vulnerable Library)
Found in HEAD commit: fc1df3b41be3f01efaf3bc1b191cb27d84c53f21
Found in base branch: main
### Vulnerability DetailsGraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.
Publish Date: 2021-11-04
URL: CVE-2021-41249
### CVSS 3 Score Details (7.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7,https://github.com/apollographql/apollo-server/security/advisories/GHSA-qm7x-rc44-rrqw
Release Date: 2021-11-04
Fix Resolution: 2.25.2
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2021-0418
### Vulnerable Library - apollo-server-core-2.8.1.tgzCore engine for Apollo GraphQL server
Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.8.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/apollo-server-core/package.json
Dependency Hierarchy: - :x: **apollo-server-core-2.8.1.tgz** (Vulnerable Library)
Found in HEAD commit: fc1df3b41be3f01efaf3bc1b191cb27d84c53f21
Found in base branch: main
### Vulnerability DetailsNPM package apollo-server-core version 2.0.0 through 2.25.2, and 3.0.0 through 3.4.0 are imacted. Fixed in 2.25.3 and 3.4.1. In certain configurations, Apollo Server serves the client-side web app "GraphQL Playground" from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations. There is a cross-site scripting vulnerability in GraphQL Playground that allows for arbitrary JavaScript code execution in your web server's origin. If a user clicks a specially crafted link to your GraphQL Playground page served by Apollo Server, an attacker can steal cookies and other private browser data. Details of the underlying GraphQL Playground vulnerability are available in this graphql-playground advisory. (A similar vulnerability exists in the related graphiql project.) This advisory focuses on identifying whether Apollo Server installations are vulnerable and mitigating the vulnerability in Apollo Server; see the other advisories for details on the XSS vulnerability itself. The impact of this vulnerability is more severe if (as is common) your GraphQL server's origin URL is an origin that is used to store sensitive data such as cookies. In order for this vulnerability to affect your Apollo Server installation, it must actually serve GraphQL Playground. The integration between Apollo Server and GraphQL Playground is different in Apollo Server 2 and Apollo Server 3. You can tell which version of Apollo Server you are running by looking at the version of the package from which you import the ApolloServer class: this may be apollo-server, apollo-server-express, apollo-server-lambda, etc.
Publish Date: 2024-11-03
URL: WS-2021-0418
### CVSS 3 Score Details (5.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/apollographql/apollo-server/security/advisories/GHSA-qm7x-rc44-rrqw
Release Date: 2021-11-04
Fix Resolution: 2.25.3
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2023-0313
### Vulnerable Library - apollo-server-core-2.8.1.tgzCore engine for Apollo GraphQL server
Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.8.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/apollo-server-core/package.json
Dependency Hierarchy: - :x: **apollo-server-core-2.8.1.tgz** (Vulnerable Library)
Found in HEAD commit: fc1df3b41be3f01efaf3bc1b191cb27d84c53f21
Found in base branch: main
### Vulnerability DetailsApollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value.
Publish Date: 2024-11-03
URL: WS-2023-0313
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-j5g3-5c8r-7qfx
Release Date: 2023-08-31
Fix Resolution: 2.26.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.