Cross-site Request Forgery (CSRF) Affecting apollo-server package, versions >=2.0.0 <2.25.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-APOLLOSERVER-3043107
- published 13 Oct 2022
- disclosed 12 Oct 2022
- credit Unknown
How to fix?
Upgrade apollo-server to version 2.25.4 or higher.
Overview
apollo-server is a Production ready GraphQL Server
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) if the server uses graphql-upload and SameSite=None cookies for authentication. JS on any origin will then cause browsers to send cookie-authenticated mutations to the GraphQL server, which will be executed without checking the CORS policy first.
Workaround
Users who are unable to upgrade to the fixed version can specify uploads: false to new ApolloServer to disable the graphql-upload integration and protect against CSRF mutations, given that the uploads feature is not used.
The server will still be vulnerable to non-mutation CSRF attacks, such as timing attacks against query operations;
Users need to upgrade to the fixed version and enable CSRF prevention to protect against these attacks