Using CodeQL to Investigate GraphQL Resolvers

Key Takeaways

this here is a tool used by red teamers and blue teamers called red eye it's developed by the U.S government and we actually just found a bug live on stream using Code ql we figured out that one graphql resolver was lacking authorization checks and we were able to just query all the global operators and leak them without yeah requiring authentication here is the code ql query that we used foreign I'm trying to record a little bit of an intro for YouTube sorry if this is a bit awkward no I have not used code ql before but it's an interesting way to discover vulnerabilities across code basis or maybe even you know identify code within one large code Base by writing queries and kind of like asking about certain conditions that are kind of like vulnerabilities right code ql is from GitHub and I've not used it before here's a little bit of a an example of a example code Quail query I have no clue it's you know I don't know you use here I don't know I don't know how it works okay that's what I'm here for I try to see if I can get a basic example um going so we want to look into code ql um and use it but on what do we use it there's a reason actually why I want to look into it because right now I'm on a project like for work I cannot show you what the project is of course in there I have a bit larger code base it's a node.js server using Apollo graphql it's super annoying to test and I I got a bit lazy and so instead of doing stuff manually I was hoping you know what I could create a stream where I finally finally sit down and look at code ql and see if it can help me in this particular case there's one particular research question I had which I can do by hand but hopefully with code learning codeql it's something that just easily easily works and the specific research question I have is that graphql obviously also has author you you have to somehow Implement authorization checks or authentication checks like some API endpoints are only available for the admin some are only if you have an account some are you know bound to some organization or some other kind of Access Control you know maybe there are different levels of administrator and supports and stuff like this so so there's a lot of these kind of authorization checks right and so I was using grep.app to look for public repositories that kind of implement the same look how I searched for this I typed in at authorized for The Decorator and then I looked at path where resolver is in the name that's a typical naming scheme how node.js apps with graphql name their files right resolver typescript annotation resolvers campaign resolvers so I knew a resolver like in the name is probably then a graphql resolver and then looking for the particular decorator and we've actually found I think two great examples one of these examples is a free code Camp chapter it's like a Meet Up group planning tool or something so that's definitely a good example and then I I realized there's c i c i s a government red eye and I was like clicking on it what the heck is that so apparently red eye is a visual analytic tool supporting red and blue team operations and here's a screenshot of it command and control log visualizer Cobalt strike server and then lateral Beacon and then somehow like I don't know doing like some red teaming stuff or so no clue what this tool is for okay I'm not into red teaming and Pen testing that kind of stuff like no clue if this is a useful tool but you can see it's a website it apparently uses graphql here's the file for example here's the resolver when if you look for at authorize you can see here for example the authorized modifier being being used I guess I should maybe check if it's using Apollo yeah Apollo server it's using Apollo Server Express so here's here's the research question okay why do I want to use code shell well there are different ways to test for Access Control issues right but we have here the source code and it would be very helpful for me to very quickly run a query that figures out all graphql resolvers that do not have for example the authorization check this is a research question I have I can't even do it by hand like that's what I would be doing by hand okay they are just a limited amount of resolver files okay they're like it's a dozen or so maybe maybe 20 or I don't know how many of these are not that many right I can I can do this by hand I can open this one and then I can go through quickly okay this has it has it has it has it has it has it has it let's go out next one um has it has it has it has it has it right but I'm looking for one where they are maybe for where they forgot it with that it could be a bug it doesn't have to be a bug right there are often also resolvers that where you don't need to be authorized because it's carry some public information or so it feels like if I could learn some basic code ql maybe like it's very easy for me give me all resolvers where there's no authorization check and then I can go over the view that I found uh to uh to see logically if there's a bug or not you know is this meant to to be public or is this was this forgotten of course I could also do it with regex you know it's very easy to find all the ones that have authorized right I can just literally search for everything authorized just grab over it and I find all of them there's also maybe you know I could quickly write a little bit of a like a negative regex find everything where there's query and not authorized before it but then sometimes there are multiple decorators and like it gets a bit messy pretty quickly right the cool thing is if I could use code quail and ask for find me all classes where there's resolver in the name for example or where there's like this query decorator and check if there are other decorators that's at least that's how I imagine code ql works I'm actually not sure if that's what I can do with it but that's the goal so I was thinking you know let's take this red eye CSI that's not CSI c-i-s-a government uh thing and let's try to use codeql on that I don't know how powerful codeql is in my mind I just hope I can just query you know it's as long as this language supported it can't I don't know I don't know how it works okay we'll figure it out if it could be very well be that in 30 minutes I realize it doesn't work it does not work okay so here's the link of supported uh Frameworks C plus plus Java JavaScript type script so yeah seems fine right the standard languages Frameworks may be important it's below so with these query languages I don't know much about this okay I might speak here as far as I understand querying you know having huge graphs and query them is kind of a kind of a difficult like computational task and it can quickly explode having to keep track you know store like all the routes and stuff like this so what you can do is if there is a popular framework or Library I believe you can pre annotate these things and you can say okay this framework function or Library function is dangerous or something and then you don't need to Traverse into the complicated Library function at all because you know if if that is used then that's a problem and so it's a lot more efficient than to run your code on your own stuff that's what I assume what is doing it but I'm not sure of course I I have a friend who's working at a company who if he would see that I'm testing out code ql he's working at shift left and they have their tool called yearn backhunters workbench which is an open source code analysis platform for C plus oh it also has JavaScript based on code property graph so it's similar and he hates code ql and he says code ql is and urine is better I know also the person kind of like who invented urine behind it Fabian Yamaguchi he's a very I it's a researcher I very much respect very much look up to I always loved listening to his talks um so he they are coming out of the you know hacker Community the German hacker Community but I've never looked into it okay so maybe maybe this is another thing we I should look at at some point okay I'm kind of cheating on my friend right now yarn Run start okay let's see if we can get that run really quick so we set up a red eye we were we are able to run it there's like an interface Now with uh server password Dev I wonder if there's like a default password it's not that important actually you know we don't really care about the project itself you will want to grab the vs code codeql extension that lets you query and explore and ask T makes writing queries much easier that is great advice so let's keep that in mind I guess I first look up codeql basics in the document in the docs just getting started or something and then code ql for visual studio code I guess here are the recommendation also to to maybe get that going but let's see um how we can get that set up this is always the tricky thing with documentations right I don't want to read everything maybe I should read everything because if I look over stuff I run into issues later cook your for visual studio is an extension lets you write and run task called QR queries in Visual Studio go to the visual studio Marketplace is and click and okay we are installing code kill and so extensions code ql I guess this one here hopefully it tells us that something is missing or so like like the binary maybe itself is missing then we can download that configure x to the code QRC online the extension uses code qrcli to compile and run queries if you already have the CLI installed then add add it to your path the extension use that version this might be the case if you create your own code database instead of downloading them from github.com otherwise extension automatically manages access to the executable of the CLI for you this ensures the CLI is compatible with the code ql extension note the extension managed CLI is not accessible from the terminal if you intend to use CLI outside of the extension we recommend that you install your own copy of the CLI to avoid having two copies when you're working with code UI you need access to the standard cultural libraries this also makes a wide variety of queries available to explore there are two ways to do this recommended use the starter workspace this is maintained as a git repository which makes it easier to keep up to date with change to libraries more advanced at the cultural libraries and queries to an existing workspace the startup workspace is a git repository it contains the repository of codeql libraries and queries for all supported languages this is included as a sub module so it can be updated a series of folders named blah blah to use the starter workspace clone the repository I mean for my case I mean it's good if we can use existing queries to also query the code bases probably interesting not so sure if it's super necessary for me trying to write my own query but either way I guess it's fine if we follow the setup and make sure that everything works and stuff I tried using codequel once a while ago and kind of immediately abandoned it because I thought I can just write a query and get some answers what is all this with creating a database and so forth right so like I was immediately turned off by it but let's give it another chance okay let's create a new window file open workspace projects that's the workspace okay analyzing your projects you can run queries on codeql databases and view the results in Visual Studio code to analyze a project you need to add code ql database for that project open code QR database view in the sidebar okay so I assume I go now to my project here to red eye and then what do I do cultural databases view sidebar now I have a new sidebar does code viewer Extensions by GitHub have your permission to collect usage data and metrics no add your data you can add a database from a local zip archive or folder from a public URL what the is it what what is the database now is is the is the git repository that I downloaded is that is that a database the starter thing is that a database custom queries for JavaScript is this a database a database is a directory containing variable data extracted from the code but I have no code extracted I don't have a database yet okay sorry sorry sorry sorry here obtaining a local database okay to create a database with the code seal I use creating code curl database before you analyze your code using Code you need to create a codecules ql database containing all the data required to run queries on your code you can create codeql database yourself using the code qlcli code KL analyzes analysis relies on extracting relational data from your code install and set up codeql CLI okay now we follow this okay so here we find Linux 400 megabytes I want to use code ql Workshop but it told me I should do this what do I need to do what is codeql Workshop but it's a university Workshop I don't understand why do I need that why do I want the workshop I don't want to do this example we have our own example maybe it would have been better to use the workshop but but I'm stubborn now on my example okay and then we have here this folder like we extracted there and there's a binary okay cool maybe there's a setting code ql no um set extension settings executable path so here we can also just like code specify code ql so we take this now we go in our red eye project and then we now apparently learn how to run you can download some code ql packs by running codeql Pack download launch cultural verify code ql setup resolve ql packs run code ql resolve languages to show Which languages are available this will list the language supported by default run code create resolve QR pics to show Which codecore packs the CI can find this will display the name of okay what is the difference between ql packs and languages now query packs for each supported language for example codeql language queries these packs contain standard queries okay the the repository without we got earlier the starter the cochlea starter thing these are these ql packs or what what is that language are core packs ql packs are built in queries okay thank you then I guess somehow we can tell it that these I mean there are not no queries there okay I don't I don't know how this okay that's all weird killcro database create path to the new database to be created this directory will be created when you execute the command you cannot specify an existing directory okay best practices where do you create this now is this do you create this just in the root of your file project or do you put it somewhere else I guess you put it somewhere else right uh so in here we would do create and then maybe maybe we create like a databases whatever database create and we say databases and we call it red eye maybe red I won because maybe we I don't know maybe maybe I don't know maybe you want to update later red eye and create a new database for it and not override your current or I don't know I don't know it's just my guess and then language identifier and then we can specify the source route now let's look at the project that we have here so if you look at our code here I guess we are mostly interested in the server so I guess we can specify applications server as a source root because the client we don't care about so we add Source root equal to uh what was it application server and I guess maybe in here it's fine because I don't know maybe maybe it wants it can learn something from these modules also I don't know so now you can see here the full command that I entered code ql database create where we want to create the database in language JavaScript and as a root we want to select uh the server everybody look look at me look that flew it's not club mate it's uh schmitzy as German as it can be yeah let's look a little bit at the output here just to understand to get a bit of an idea of what is happening here so I initialize the database there it found node.js it found the node.js version it looked at the package.json this is interesting to me I want to see like it's interesting to me to know that code ql uses that information right it also found apparently a TS it uses the TS config Json file so it also looked at this at this here so that that's all quite interesting of course and then it starts going through these files apparently all these utils files done extracting done extracting okay and it ran it ran it ran it ran and then finalizing database successfully created database let's have a quick look just to get a feeling for how this database looks like so here's our database folders with red eye and there's like there's logs DB JavaScript there's a DB scheme schema stats default checksum okay this I guess the the actual database symbols signatures checksums I don't know okay this is then the weird database format okay good to know great which means now we can go here in the code ql and now we can say from a folder so now we can open this database we go to Reddit we open we choose this as our database this workspace contains a typescript version would you like to use the loading database okay I don't know okay so we have here a database okay now we can come back to to the explanation here okay so we selected a database running a query the code ql repository in good tab contains a lot of example queries is this the one that we cloned no it's something else if you have a folder or different QR code pack available in your workspace you can access existing queries under open a query file it displayed in the editor here is I guess where we go back and not run this in here but we use it in the code ql starter workspace right because it's set up like a basic this is an empty block like a basic query there that's why we want to run this in here I assume and we have here some already some queries in there I guess okay so let's set up the let's open the database in in here databases red I choose okay okay so we have it in here and now you say add database source to workspace does that just mean yeah okay it shows up project okay that's just the source archive okay that's not that important right open a query ql file it is displayed in the editor with intellisense features such as syntax highlighting and autocomplete suggestion Okay so we select now one we go like Java well can be down here is there like JavaScript extractor no what what does that mean is that something else do I want to look at this no this is like weird go back that that was scary this is a ql file and now I can go here and say run query and now it runs the example ql on red eye we ran the query now and apparently we found a lot of empty blocks so what does this what does this mean from block statement B where the statements inside that block is zero it's an empty block and now it shows us some source code where that is the case so apparently there is an empty block oh it's an empty catch it's an empty it's empty block here and then I guess we have a lot of uh where's this code line six so this is also considered empty I mean this is kind of like I guess uh it I guess it's empty because it's just a type definition or something it's just yeah it's just a sword so it doesn't have really code inside of it or something that's why it's considered empty maybe I don't know but I mean empty block I don't know how important that is it's just an example right but interesting that this this resolver is also considered an empty block I mean because there isn't is async function inside of it so why is the oh in 29 yeah so that is that whole thing here why is that considered an empty block use the AST Explorer okay that's a good point run the command on an open source file from a code ql database okay so we have this open now and we want to understand why this is an empty block right so I click view AST cannot view the AST please select a valid source file inside the codeql database or is this only for the for the query itself so click the TS file and view as to click the TS file and view AST oh maybe I was focused on the wrong window right maybe I was in a query result window or something and when I pressed view St I try to view the IST of this opened file while yeah and it didn't have this in Focus now it works yeah okay so we have an import declaration import declaration import as it's pretty cool can I also organize when I hover over it I see the the AST viewer also updates uh in case you don't know AST stands for abstract syntax tree so the syntax the language here when like the compiler also wants to understand this code to build like whatever executed or whatever you basically put this whole code you can imagine as like a big tree like in this file there are now multiple lines and that's you see them and for example this individual import declaration we can look into inside of it you see this inside of it is this link label right so so this is like the tree so this import statement and inside of it is this link and very similar down here this class link resolver inside of it uh you can now find you know additional things so so code is like this tree right nested um yeah yeah so it's it's not only the nested uh functions but it's like it goes into detail like every little statement like every little thing has an explanation what it is um and yeah so this is really like the the representation of this code basically we were looking for empty blocks and it found online 29 and empty block I wonder how we can figure this out now because line 29 doesn't like immediately show up here but it was like so here this is the links resolver here online 29 apparently like here oh no sorry line nine Sorry Sorry Miss looked okay so apparently here it felt like an empty block but I don't know like how could we understand this now because obviously according to AST is not empty however maybe it's an empty block I don't know what what so so here's maybe we can look at the example query again the query is here the number of statements let's see if we go in here like yeah yeah look here so this here is a block statement it's a complete code statement it's a block statement I don't know like I don't know the exact definitions of these things right but it kind of makes sense that this is like a block with a lot of statements inside I guess there's a declaration statement where it declares this variable there's a return statement and inside of it I'm sure we can find like a method called expression you know I don't know so so these are individual statements and inside of links so so this function expression is not empty because it contains statements but the links resolver if you look at that this whole thing here only contains a class definiti like directly only a class definition and type definition because we Define here a class right so there's no there's no statement inside of it we only have a class definition and a type definition and inside of it sure there's there's it it then defines here something that has a statement but directly itself it has no statements and that's I guess why when we write a query like this we look at all the block statements and if there's a block statement that has no statements inside of it then it's an empty block that's my interpretation of this code at least it's not get num statement equal equal zero this is not JavaScript this is code ql this is the query language so this is more like SQL right like selected from where or yeah or kind of the reverse I don't know it's called ql we got to learn a new language here so my goal for today I want to try to learn how to use codeql to write the query that finds all resolvers and checks and and gives me all the resolvers that do not have the authorized or like our queries whatever uh that do not have the authorized decorator so that's the goal so here we have a resolver maybe we can already learn from this I want to look at all functions that have the query um decorator that's probably a good way to do it I want to find all functions that have query and then check if it does not have the authorized decorator that's kind of like what I wanna find out so if we look in here I guess we want to have the AST thing we can see here decorator there's probably a query right where we can look for all query decorators and then we can probably like look like for zip siblings what are the other decorators there right is that is that a kind of query we can write so let's create a new file that we save maybe decorator.ql save and then I like import JavaScript could not resolve module do I need a ql pack file so I guess I also need to I need I need to create this right a ql pack file and put that into the into the same folder I would write your query in the workshop folder what is the workshop folder also what happens if there's a decorator that calls authorize itself you mean a more complex Opera like if there's another um decorator that's called staff only and I only account for authorize right now while staff only also does it well that depends on the code base you know different code bases use different functions this isn't yeah it has to then be adjusted based on like if we would run this and see oh all the stuff that have the authorized missing have staff only then we add okay we also don't care about staff only after we've reviewed how the authorization check or uh staff check is done if we consider it safe or something you know it's it's a fails let's first even for those uh decorators the code custom JavaScript query folder okay but I want to have like my own query okay wait maybe I just copy this right maybe that's that's the way to do it copy the Java Script example and I call it graphql declarator why is it not in here oh my God I hate I hate computers to get a custom folder oh my gosh I see already this is terrible it's all pretty awful okay okay we we don't now we have our own folder okay and we don't get arrows in here so so the setup here seems to work we can rename this now to also graph ql deck curator how do I know now how the syntax works we know from the AST that there's a decorator can can I can I do like from decorator huh D select D test okay so if I run this should I get every decorator ever my my run craft QR button is gone how do I run a graphql query now okay cultural run query cool we find all decorators nice so now I can do where The Decorator I I'm I'm now looking for all query decorators okay I I want I only want the query decorators how can I filter for the snow get token get parent get type get type Maybe okay wait let's print out all types is this is this the way to do it how I do it right now or is that an easier way to like explore and slowly build your query or or is this like the intended way to always now run the query and see like get a bit of debug output I feel like with big source code it would get very slow to do this uh it already I guess it's like super slow now it does amazing caching okay but now I have zero results why would why does this give me results but when I want to see the the type of it this then fails get type is probably not the because it gives us back the type so it's probably type decorator or something maybe it doesn't have a type that's why it doesn't select anything or I don't know astino strings get a primary ql class get get a successor as a control flow a token a basic block is T node so get type what did that return get kind is an integer Hmm this is so weird what what did it find now why does why do I not get now where it found it select D this is this is this represents the so I need to do select D and then maybe get kind yeah okay now we have now we see here all of them we could click on them and it brings us there okay now I understand it's like automatically so then test and then D is like 94 okay no idea what yeah get but get type this there's also invalid result patterns show log it just doesn't like okay could not process any query metadata expect alternating entity string and string columns no clue what that means yeah select is the output I understand I want to get the type or or like the name of it get name but but it's it's not but maybe it's a token or something like what represents the name uh get element get container get expression I guess I want the the actual name of The Decorator let's see if jet GPT knows this maybe maybe you know write a culture for JavaScript find all decorators with the name query okay it says there's get name but there's no get name or at least here it says cannot be resolved get expression expression also expression doesn't have a get name basic block uh cannot resolve for type basic block okay so maybe okay maybe that's the IST help us so if I have a decorator here but but as you can see like in the AST there's a decorator that it has like right here like this name or maybe call expression and then the VAR reference is query so can we go like somehow find the call expression then vow reference or something so uh get call no get expression and then VAR get string value how can you debug queries just get the expression don't get the string value oh okay this looks good but but how can I just output like if I want the string value because I want to write you know how can I so where D dot get expression equal to a query this will not work right because what what the is query it's like not a known type and equal to string doesn't work because expression is obviously not a string how do I now know if the string value is really like looking like this see at query or is it query now you know like yeah look at these explanations gets the expression of this decorator for example The Decorator at a has expression a and a testable true as the expression testable true name no get string value so what is the String value gets the constant string value this expression evaluates to this of course is not what we want it determines the typescript type why is this causing an error I guess because the expression is not correct so if we do get this if we try to get the type of that oh there there exists two string on it uh okay now this output was interesting method decorator method in prop decorate okay but not quite what you want okay so you say get expression to string oh there's a two string okay I also don't understand what this like what is this output by the way I said D and then the string why is it now the other way around why is it now a message why is it not no table I don't understand this automatic parsing I don't want this can can I make this can I make this like a proper table because I have like two values that I return here ah okay here okay and then we can maybe contains index off is that is that ugly is that not how we should write it because of course we can do like I guess index of not minus one now we should only find queries right this is ugly are you judging me nice now we find all the queries cool here's a query three here's a query nice and then we wanna end D dot get sibling get I guess we can get go to the parent and now we want to like somehow say contains how can I now say say does not contain a decorated child with authorization it would be good to know like how can I now query children I think now it's time to look at some example code ql queries okay wait no um let's ask uh well you know the syntax was not quite right with uh GPT generally okay extend the query with another where clause where the parent contains no child with decorator name authorization okay here it looks for methods that con up with contain D that's interesting how can I now look through all children maybe children only works on methods check all sibling decorators to not have the name authorization maybe the subs it's very academic see what I mean yeah sure I mean I just have to wrap my head around like this query syntax also we could also it's like an interesting query still like find all queries that have authorization D1 index of query and the two index authorize and then show me the query we are just playing right we are just learning so this is a fine small learning query oh no no this this is from and and D1 dot get parent is equal to the two dot get parent this is of course like this okay so here we should get all the queries that are authorized that's pretty cool already but how can I check for this like the this is like a very weird inverse like you know but this was already helpful this is still like kind of helpful we want one decorator again and then get parent Dot get a child star is this a special like syntax with star why are query languages like this why is it so much why are they like this and why can I not say how can I make sub queries if I could like make a sub query I could like get all I could find all queries or like I could find all you know parents of decorators that contain authorize because like if I if I can query all of them that have authorized and then I then I do like where it's not in that sub query can I can I do that can I create a sub query and check if one element is in this sub query why where did it pull this query from where it looks for users that are at least 18 years old what the is this kind of query I feel like does it does it not feel like maybe maybe it's wrong because this feels like it's mixing SQL because now this is Select from where maybe it looks like a regular SQL query because this is a SQL query and Jet GPT just made like try to its way this is wrong I haven't seen this yeah I assume so too I assume I think code ql just dreamed up because I assumed like it exists and it just tried to if you want to learn bullshitting in interviews chat have a little bit of chat with codeql it's a it's amazing at bullshitting then I guess let's do the traditional Google code search code ql sub queries oh I I'm just here look here there are different queries and you can have an alert query a path query diagnostic query for troubleshooting and as a summary and if we look in our code we see here it's kind problem so if we change this to diagnostic then that's more like what we want right we want to run a diagnostic query okay zero results Great and then problems would be we don't have a problem so I can remove that I guess why is it defaulting to alerts still I would have hoped that by removing that it wouldn't go there anyway anyway it doesn't matter your suggestion this here no results but I mean this is already uh pretty good right we can maybe use this to modify our code here D1 dot get parent dot get a child only the decorate froth type decorator index of authorized minus one is not authorized okay let's see okay we find three queries and they don't have authorize nice interesting look what we found here so apparently there is a progress resolver showing you the progress of a task the thing is just I'm broken so this is apparently broken code like you can't get the pro pausing progress anymore or something it's it's probably not used anymore maybe replace with this quite interesting so so it's not useful for security I guess if they right here I'm broken and then the other net what is this here so this is Operator resolver Operator sounds pretty serious oh we should for queries we should look for queries or mutations and this is I guess like this research process right like that what what I was hoping for that you can then adapt it a little bit and run another query so actually that's before we move on let's extend our query so we look for queries or mutations and then we run this query why did we not find the mutation here view AST so in here we have a decorator mutation so yeah we we should find it as well mutation go through all decorators and we check if their two string is either query or mutation where the parent we check all the children decorators and none of them should be index of authorized so none of them should have authorized in there you should it matched the first condition of the ore and stopped but this is a separate decorator right so here this decorator has no query it it matched two decorator uh two queries in the same file so it matched these two queries perfectly so why would it match these individual queries this decorator in this decorator but not match this decorator it's an or so if this does not match it has to check if this is true you changed your query and you find four now oh you are looking also does anybody know why this doesn't work like I want to understand this I know we can maybe test your query but yeah remove the not check and see if it um if it matches a mutation you're right we should do that very query query it only matches queries and if I switch this around it's still only found queries now look only for mutation it doesn't find any mutation why not so if we look in the AST it is a decorator it's considered a decorator but maybe get like two string it's not called mutation is this the issue because the two string uh does this I guess this is the issue because the two string makes like this weird string out of it this cut this Con this shorter string so this is bad this is not something we should do this to string so maybe geek measure used a different way of getting these names so you used get calling name call you use this on call expression but this is the this is the child that the call expression would be the child so this this would still okay if we then get all child Expressions maybe this is good enough and then get call child expression and we want to get our call expressions get call Lee name in and then we can have a list of mutation and query okay that worked we found now all mutation and queries thank geek mesh that was uh your your query was helpful to learn about that so now we have this and not we go to the parent get all the decorated children and check their expressions are of like those are like the Blacklist okay now we find four uh results like geek measure mentioned uh with their query so we find this one mutation now as well that is of course an interesting that is of course that might be a bug like my first impression like we need to look now a bit closer but apparently operators if there are no other ways of enduring this it appears to be that you can list as well as CR create Global operators let's click around really quick on here if you see something about like operators so we create a test campaign select the campaign folder with multiple Cobalt strike server folders okay seems like we cannot use it without I don't know Show an example browse is that an example would be cool to have some example data to pull in there query campaigns okay so there's a cookie if we remove that cookie and drag graphql we get access denied if we now try to query something else uh no wait campaign that's a query name sorry sorry I'm I'm an expert I know this okay this is the query name test and we query campaigns type name campaigns or something I don't know whatever okay and if we try now here's something else we should get an error this query does not exist Okay cool so now what we figured out kind of is that there's this operator resolvers and I guess uh so so how does this work I'm not a graphic expert okay so resolver operator campaigns like if you do operators okay field operators argument campaign ID is required but it was not provided operators okay this didn't require any arguments what is this Global operators it's the function name here right so this should work yeah okay we query Global operation let's remove the cookie and see what happens we can still call it without the without the cookie I but I don't know like maybe Global operators is meant to be called you know without so maybe let's try the the mutation I forgot how to do mutations um uh we cannot filter I oh my God okay wait um how does a graphql mutation look like again okay wait wait wait wait wait wait this is a graph ql resolver right the graph ql mutation query to create a new operator create the complete post request okay let's test it create Global operator test cannot query field username did you mean name apparently we created our Global operator John Doe we can let's query we created the John Doe holy graph uht coming in from the side again amazing cool we found the back should we should we create so that does this now show up here in The Operators or something like no clue what this did no clue I have no clue where this shows up now does it show up in the UI no I like it's it's maybe it's maybe old cold forgotten coded maybe it has no value whatsoever uh like it's a super low bug okay like this is not critical if it's something would be something critical maybe we should be more concerned showing it on stream or something but I really don't like you can argue with me but this is like a lame bug okay it is a bug and it's cool that we found it I think it's technically a valid um Access Control bug but yeah it doesn't even show up here in the UI you know maybe it would have been interesting maybe for like xss issues you know to escalate further would be cool let me quickly just report this and then I think I will actually call it operator resolvers missing authorized curator The Operators of solvers are missing authorized decorators which allows anybody to query operator names without Authentication uh to reproduce and this post request to the graphql endpoint the response will leak the registered operator names example response the mutation also selecting the authorized decorator does allowing creating Global operators without authentication to fix this simply add the authorized decorator to our queries background info uh we created this code query this here is a tool used by red teamers and blue teamers called red eye it's developed by the U.S government and we actually just found a bug live on stream using Code ql um we figured out that one graphql resolver was lacking authorization checks and we were able to just query all the global operators and leak them without yeah requiring authentication here is the code ql query that we used clip in and ship it thank you very much for hanging out with me that was very educational I think we learned a lot it couldn't have gone better that we test out codeql and we find a valid back of course this is a very it's it's not it's not an important back okay it's nothing crazy okay but it is technically an authentication book and access control ACL bug whatever you want to call it okay and that is that is pretty cool [Music]