Remote code execution when loading a crafted GraphQL schema
Package
Affected versions
>= 2.4.0, < 2.4.13
>= 2.3.0, < 2.3.21
>= 2.2.0, < 2.2.17
>= 2.1.0, < 2.1.15
>= 2.0.0, < 2.0.32
>= 1.13.0, < 1.13.24
>= 1.12.0, < 1.12.25
>= 1.11.5, < 1.11.11
Patched versions
2.4.13
2.3.21
2.2.17
2.1.15
2.0.32
1.13.24
1.12.25
1.11.11
Description
Credits
-
yvvdwf Reporter
-
rmosolgo Remediation developer
-
joernchen Remediation reviewer
-
adarshan-gl Remediation reviewer
Summary
Loading a malicious schema definition in
GraphQL::Schema.from_introspection(orGraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.