Attacking and defending GraphQL applications: a hands-on approach

Seattle | September 16-17, 2019
Attacking and defending GraphQL
applications: a hands-on approach
DAVIDE CIOCCIA
STEFAN PETRUSHEVSKI

$id
Davide Cioccia
@davide107
david3107
Stefan Petrushevski
@ztefan
theztefan

Agenda
• GraphQL basics: Query, Mutation, Subscription
• Security Implications in GraphQL
• Lab1: Introspection
• Lab2: DoS
• Lab3: Mutations
• Lab4: IDOR and Authorization bypass
• Lab5: Injections

GraphQL
https://graphql.org/
A query language for your API
GraphQL is a query language for APIs and a runtime for fulfilling those
queries with your existing data. GraphQL provides a complete and
understandable description of the data in your API, gives clients the power
to ask for exactly what they need and nothing more,
makes it easier to evolve APIs over time, and enables powerful
developer tools.

GraphQL
Optimizing the data fetching problem by
switching from imperative to declarative
data fetching

GraphQL vs REST API

REST API GraphQL
vs

Common use-case

GraphQL basics

Create a schema

Define an operation
• Query
• Mutation
• Subscription

GraphQL query

GraphQL mutation

GraphQL subscription

LAB: GraphQL basics

Repo
git clone https://github.com/david3107/graphql-security-labs
cd lab3-mutation
docker build . -t graphql/mutation && docker run -ti -p 5000:5000
graphql/mutation

Security Implications in GraphQL

What can go wrong
• Introspection
• DoS
• Injections
• Broken Authorization
• Insecure Direct Object Reference (IDOR)

Introspection

What’s introspection
• Allows us to ask a GraphQL schema for information about:
• Queries
• Mutations
• Subscriptions
• Types
• Directives

What can we ask for
• Querying all available types in a schema
• __type
• __typename
• All available queries
• queryType
• deprecations
• List of enumerator values
• __type(name: "<ENUM TYPE>")
• All types associated with an Interface or Union
• __type(name: "<INTERFACE OR UNION TYPE>")

Ask for available types and queries

How can we abuse it?
• Information disclosure
• Sensitive information related to the objects
• Retrieve “hidden” queries to bypass controls
• Use it as a steppingstone for further attacks

How do we prevent it?
• Disable introspection. D’oh!
• Npm module
• https://www.npmjs.com/package/graphql-disable-introspection
• One Python hack
class NoIntrospection(ValidationRule):
def enter_Field(self, node, key, parent, path, ancestors):
field_name = node.name.value
if field_name == "__schema" or field_name == "__type":
self.context.report_error(
GraphQLError(u"GraphQL introspection is not allowed", [node])
)

LAB: Introspection

Repo
cd lab1-info-introspection
docker build . -t graphql/intro && docker run -ti -p 5000:5000
graphql/intro

Challenges: DefDev social network

Architecture
+ +

DoS: Nested queries

Nested queries
• Let’s consider the following schema

Nested queries

Nested queries: complexity calculation
9999 messages x 1 thread
+
+

Result

How do we prevent it?
• Limit Maximum Query Depth
• Calculate Query Complexity
• Throttling Based on Server Time
• Audit your query before production

Limit Maximum Query Depth

Limit Maximum Query Depth
• Pros
• Because the AST (Abstract Syntax
Tree) is statically analyzed the
query is never executed
• Cons
• It’s very difficult to cover all the
possible query combinations

Calculate Query Complexity
Allow only LOW query complexity. If we set query complexity to 4 this query would fail

Calculate Query Complexity
• Pros
• Covers more scenarios
• Do not execute the query
• Cons
• Hard to maintain
• Difficult to calculate
• Mutations can be tricky :/

Audit your query before production
• https://www.npmjs.com/package/graphql-validation-complexity
• https://github.com/4Catalyzer/graphql-validation-complexity
• https://github.com/slicknode/graphql-query-complexity

LAB: DoS

Repo
cd lab2-dos-resource-exhaustion
docker build . -t graphql/dos && docker run -ti -p 5000:5000
graphql/dos

Goal
• Take down that social network

Broken Authorization & Insecure
Direct Object Reference (IDOR)

Quick recap on IDOR

So IDOR is a GraphQL problem
….but wrong implementation of GraphQL filtering functions can lead to
IDOR vulnerabilities.

What can go wrong?
• Mutations containing predictable IDs
• Perform action on behalf of other users
• Query to retrieve data about single elements
• Retrieve other users' data

How do we discover IDOR? Step 1
• Use introspection to find all the available queries

• For each query detect the associated Type
• For each object print out the available Fields

• For each object detect predictable element (Int, Enum, etc)

• Try different values and see what happens :)

LAB: IDOR

Repo
cd lab4-IDOR
docker build . -t graphql/idor && docker run -ti -p 5000:5000
graphql/idor

Goal
• Use IDOR vulnerabilities to retrieve other users' private info
• Authenticate as another user

Injections

Are Injections possible?
• Yes, injections vulnerabilities are present
• Yes, because of bad implementation (bad coding)
• All web vulnerabilities are potentially present in GraphQL

How do we prevent Injections (and other)?
• Use secure coding principles and practices

LAB: Injections

Repo
cd lab5-injections
docker build . -t graphql/injection && docker run -ti –p
5000:5000 –p 1337:1337 graphql/injection

Goal
• Use the knowledge from previous labs (hint: introspection)
• There are two different injection vulnerabilities in the lab. Exploit them to:
• Get a remote shell on the machine (use port 1337)
• Get the passwords of all administrator users

Thank you!

About defdev.eu
• Defensive development – hardening developers
• Hi-end secure development and S/SDLC trainings
• handsons/labs, DIY testing/hacking, exams, certification
• senior security testers and enterprise developers on stage
• from mobile to mainframe
• from C#, JS and Java to Go, Swift and Kotlin
• from practical cybersec to security in CI/CD

Attacking and defending GraphQL applications: a hands-on approach

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a Attacking and defending GraphQL applications: a hands-on approach

Similar a Attacking and defending GraphQL applications: a hands-on approach (20)

Más de Davide Cioccia

Más de Davide Cioccia (10)

Último

Último (20)

Attacking and defending GraphQL applications: a hands-on approach