GraphQL Security for Beginners

Key Takeaways

graphql has been around for a while now and represents a paradigm shift in API development it serves as both a query language and a runtime environment for executing queries so today we'll go through a brief primer on what graphql is and then look at some of the features we can abuse to glean information and steal sensitive data if you enjoy the video then don't forget to like And subscribe and let's dive in all right so most of you watching probably have a good grasp of rest but maybe you haven't had the chance to experiment with graphql yet so before we dive into the lab let's do a quick comparison in a rest architecture you typically have multiple endpoints each designed to return a specific data set or to carry out some kind of operation for example you might have/ API users uh for user data and then API posts and this returns all of the posts that are in the database and if you need data from both you'd basically have to make two requests now graphql uses a single endpoint where clients can request complex data in a single query and this is achieved through its type system and query language so if we consider a social media application so with rest fetching a user profile and all of the posts and maybe the number of followers or a list of followers might require a number of API calls um probably three or more now with graphql you can get all of this data in one request and also avoid over fetching so it's not going to give you loads of Access Data as well so what we do is we specify exactly the fields that we need from each object and while this flexibility is powerful it does have some security considerations for example we need to carefully consider the query complexity to avoid denial of service and we also need to implement proper field level authorization to avoid things like unauthorized access to information or information disclosure vulnerabilities and this process of validating queries and making sure that clients have access to the right data can be more complicated when we introduce nested queries as well rather than just a single endpoint that returns a set of data when we can decide hey the client has access or the client doesn't have access set a new standard in your professional Journey with TCM security certifications and dive deep into advanced cyber security tactics with our comprehensive courses our challenging exams are designed to test your skills to the fullest preparing you for real world cyber security roles explore certifications dotcms sec.com and redefine your professional potential so so let's take a quick look at this lab and all we have is a couple of users and a couple of posts and you can see here we have the type definitions and these types are basically like objects so we have a a user type and it has all of the information and then we have a post type and it has information and we have a query type as well and then we have resolvers so here are kind of top level resolvers so if we query users it's going to return all users if we query a user it's going to run this function and grab the user ID and return that information as well and then when we come on to nested queries or if we're trying to grab posts and followers and things like this then this is going to resolve that as well all right so let's run lab with node app.js and then all we're going to do is come to Here Local Host 4,000 and here we have the Apollo sandbox so we're just going to come into query our server so that we can interact with our application without needing a front end and here this example query is probably going to give us an error so if we just run this you can see that obviously example query doesn't EX exist all right so here what we want is we want to query the user and we're going to pass in an ID so we go user ID and we're going to pass in one and then here we're just going to pass in the name so hopefully it Returns the name of the first user and this query kind of fetches only basic information but is a good starting point and it's basically equivalent to the rest API end points so something like SL API SL users SL1 and in the same query if we wanted to grab the posts of that user we could do something like we can grab that name and then we can say hey posts like this and in here we can get the title of our posts and here you can see that Jeremy has two posts one called my first post and the second one called introspection is the direction and of course we can include other fields in here too so for example if we wanted the content of a post depending on where we are in the application we might only want to grab the title so that we can list the posts because the content might be really long and this would result in a large response in this case our content is quite short but of course we can optionally include the content as and when we need and this really demonstrates graphql ability to let the client Define exactly what is needed in the resp response and avoids over fetching and under fetching so over fetching being fetching too much data and under fetching being not ref fetching enough data and resulting in multiple queries and in this case we don't need to send multiple requests we just have one query and it gives us exactly what we need and of course we could do other things so for example we could nest in here followers and let's say we want the name of all the followers of Jeremy so this was like a profile for Jeremy we have his name we can highlight the posts that Jeremy has on cards and we could list the followers below as well so there's of course a lot more to graphql than this and we haven't touched on things like mutations where we can update data and subscriptions but for part one I think this is enough to get us going and if you want more detail then let me know in the comments below and I'll make a graphql part to and of course I have a graphql module in my Advanced web hacking course so you can check that out as well just remember that with graphql the client Define defines exactly what data they want at each level everything comes from a single request so send one query instead of multiple requests like we do in rest and the API has a lot of flexibility so it doesn't need to change to support new client requirements with this structure different clients can query different information as needed so let's move on to introspection next so now let's talk about graphql introspection which is a powerful feature that lets clients query the graphql API to better understand its schema and introspection queries retrieve details about types and Fields and operations and documentation and this capability is one of the reasons why graphql is so flexible and kind of like developer friendly I suppose and it's worth noting that often introspection is enabled by by default and often considered a feature rather than a security risk and obviously if you have feelings about whether introspection should be enabled or disabled on production systems I think it should be disabled then let me know down in the comments below but the main argument for it is that disabling introspection is is kind of security through obscurity because it's only giving you information about the schema but in a perfect world systems would be secure and then it wouldn't matter but obviously no system is perfect and no implementation is perfect either so disabling it is going to make our job as attackers a little bit harder because we're going to have to dig or we're not going to have access to information that would help us exploit the Target anyway let's take a look at how we can use introspection in burp Suite so here what I have is a post and you can see that we're posting to just slash but of course often you'll see SLG graphql or slv1 graphql or something like this but usually it's quite easy to identify the graphql endpoint and if you have the in graphql plug-in installed you can see the query here in a slightly nicer format but BB Suite does have an automatic detection for this as well but I find that more often than not this is a little bit malformed on the spacing is off and things like that so generally I just look at the nql one but either way we come over to repeater and we can use either of these and just send and then you can see that we get the same data back that we did before so we have the Jeremy and his posts and the followers as well so to do introspection all we need to do is right click come to graphql and set introspection query and there are a number of different queries that we can use for introspection some of them grabbing more information than others and maybe on some targets there's some filtering so introspection might be enabled but somewhat filtered and we might not be able to use the schema keyword for example and we'll have to do something else but that's a topic for another video and once we hit send we get all of the information back about our Target and this is kind of complicated in terms of like we don't want to have to sit and pick this apart so there's a couple of things that we can do here first we can right click and go to graphql and save graphql queries to the sitemap and then we can just come over to the targets come to Local Host here and here we can see all of the queries so we can use these as a base for our attack second what I like to do is come to here and grab the query copy it come over to CH Chrome and then graphql Voyager and if we come to graphql kit.com graphql Voyager hit change schema come to introspection paste the results in we can see our schema in in a visual way and if I move my face out of the way we can see our top level queries so when we query user we can see our user type which is basically a user object the information in here and then also we can see posts and how they're linked together as well and when we're looking at denial of service and things we want to look for we want to look for recursion so if we query users we can then grab the posts and then from here we can grab the user again and we can maybe cause denal a service with nested queries but what we're actually looking at today is for information disclosure so here I can see a couple of sensitive fields that we might not want anybody to be able to access and of course the email field could leak users emails and the password field could leak users passwords so let's see whether we can go ahead and do this and find a information disclosure vulnerability and what I'm going to do is I'm going to go back to my original query here and in the user all I'm going to do is let's say let's change this to user 2 for example here we have Jessie and we're not actually logged in as anybody at the moment because it's a very simple application there's no real authentication but here I'm just going to add email and password so when we're querying this user we get this information back and this is is a common issue with graphql in that we get information disclosure issues and of course if I come back and switch this user to user ID 1 here we can get Jeremy's password and email as well I would say more often than not you're going to find things like email addresses um personally identifiable information pii but occasionally you'll find things like passwords as well depending on the application obviously you're going to Target different things you might find API Keys you might find hidden posts you might get access to messages that you shouldn't have access to and so yeah this is one of the common weaknesses with graphql and something that you definitely have to test for this example was fairly straightforward because introspection was enabled we can easily see the schema we can see all of the relationships between the types or objects but there are other ways to glean information for example when introspection is disabled we might use field stuffing or other techniques to get information and continue attacking our Target but again those are topics for another video and that's it for this video I hope you enjoyed the topic and learned something new and if you want to go deeper into graphql then I recommend picking up the book black hats graphql it's an excellent book or if you prefer video then you can check out the advanced web hacking course over on TCM Academy catch you next time