WS-2021-0418 (Medium) detected in apollo-server-core-2.16.1.tgz

[mend-bolt-for-github[bot]]

WS-2021-0418 - Medium Severity Vulnerability

Vulnerable Library - apollo-server-core-2.16.1.tgz

Core engine for Apollo GraphQL server

Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.16.1.tgz

Path to dependency file: /aws-node-typescript-apollo-lambda/package.json

Path to vulnerable library: /aws-node-typescript-apollo-lambda/node_modules/apollo-server-core/package.json

Dependency Hierarchy: - apollo-server-lambda-2.16.1.tgz (Root Library) - :x: **apollo-server-core-2.16.1.tgz** (Vulnerable Library)

Found in HEAD commit: dcbe4aefe4b3685f4b15493a01db0f19b118a0c4

Found in base branch: master

Vulnerability Details

NPM package apollo-server-core version 2.0.0 through 2.25.2, and 3.0.0 through 3.4.0 are imacted. Fixed in 2.25.3 and 3.4.1. In certain configurations, Apollo Server serves the client-side web app "GraphQL Playground" from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations. There is a cross-site scripting vulnerability in GraphQL Playground that allows for arbitrary JavaScript code execution in your web server's origin. If a user clicks a specially crafted link to your GraphQL Playground page served by Apollo Server, an attacker can steal cookies and other private browser data. Details of the underlying GraphQL Playground vulnerability are available in this graphql-playground advisory. (A similar vulnerability exists in the related graphiql project.) This advisory focuses on identifying whether Apollo Server installations are vulnerable and mitigating the vulnerability in Apollo Server; see the other advisories for details on the XSS vulnerability itself. The impact of this vulnerability is more severe if (as is common) your GraphQL server's origin URL is an origin that is used to store sensitive data such as cookies. In order for this vulnerability to affect your Apollo Server installation, it must actually serve GraphQL Playground. The integration between Apollo Server and GraphQL Playground is different in Apollo Server 2 and Apollo Server 3. You can tell which version of Apollo Server you are running by looking at the version of the package from which you import the ApolloServer class: this may be apollo-server, apollo-server-express, apollo-server-lambda, etc.

Publish Date: 2021-11-04

URL: WS-2021-0418

CVSS 3 Score Details (5.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/apollographql/apollo-server/security/advisories/GHSA-qm7x-rc44-rrqw

Release Date: 2021-11-04

Fix Resolution (apollo-server-core): 2.25.3

Direct dependency fix Resolution (apollo-server-lambda): 2.17.0

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.