GraphQL Circular-Query via Introspection Allowed: Potential DoS Vulnerability

Description

The GraphQL API allows introspection and does not restrict query depth, enabling attackers to construct deeply nested queries with circular relationships. These maliciously crafted queries can consume excessive server resources (CPU, memory, and processing time), potentially leading to service degradation or complete denial of service for legitimate users.

Remediation

Implement query depth limiting to restrict the maximum nesting level allowed in GraphQL queries. This prevents attackers from creating excessively complex queries while maintaining functionality for legitimate use cases.

For Apollo Server (Node.js):
Install the depth limiting package and configure it as a validation rule:

npm install graphql-depth-limit

const depthLimit = require('graphql-depth-limit');
const { ApolloServer } = require('apollo-server');

const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [depthLimit(10)] // Limit queries to 10 levels deep
});

from graphql import GraphQLError
from graphql.language import FieldNode
from graphql.validation import ValidationRule

class DepthLimitValidationRule(ValidationRule):
    def __init__(self, max_depth):
        self.max_depth = max_depth

    def enter_field(self, node, *args):
        # Calculate depth by traversing ancestors
        depth = 0
        for ancestor in self.context.get_ancestors():
            if isinstance(ancestor, FieldNode):
                depth += 1
        
        if depth > self.max_depth:
            self.context.report_error(
                GraphQLError(
                    f'Query exceeds maximum depth of {self.max_depth}',
                    node
                )
            )

# Apply the rule when executing queries
from graphql import validate

validation_errors = validate(
    schema,
    query,
    rules=[DepthLimitValidationRule(max_depth=10)]
)

References

Related Vulnerabilities