1. GraphQL the AppSec perspective
2020-12
Get your white hat ready

2. VLADIMIR DE TURCKHEIM
Lead Customer Engineer @ Sqreen
: Node.js Collaborator
: Node.js Security WG member
: Former Cyber-Security consultant
@vdeturckheim
vladimir@sqreen.io
@poledesfetes

3. I AM NOT A GRAPHQL EXPERT
“booooo!”
MY IMPOSTOR SYNDROME
@poledesfetes

4. I do Web Application security
@poledesfetes

5. I protect apps
@poledesfetes

6. I attack apps
@poledesfetes

7. I am also a developer
@poledesfetes

8. GraphQL is just “another way to exchange
data between a client and a server”
@poledesfetes

9. As any abstraction, it is designed to make
your life easier!
@poledesfetes

10. But abstractions can make you forget about
@poledesfetes
implementation details

11. But abstractions can make you forget about
@poledesfetes
implementation details

12. @poledesfetes
implementation details

13. @poledesfetes
implementation details
This is where the fun is!

14. But I am going too fast
@poledesfetes

15. HOW WOULD ONE ATTACK A GRAPHQL APP?
“Why is my hat turning grey?”
NICE HACKERS
@poledesfetes

16. Identifying that the application is using
GraphQL
@poledesfetes

17. @poledesfetes

18. Identifying use of GraphQL
@poledesfetes
Applications using GraphQL can easily be identified
• Use of GraphQL-related libraries
• POST requests to a /graphql endpoint
• POST requests with GraphQL payloads

19. What comes next?
@poledesfetes

20. Identifying the schema!
@poledesfetes

21. Abusing Introspection
@poledesfetes
GraphQL has introspection features.
A simple query can be used to identify the schema

22. Live demo
@poledesfetes

23. Introspection might be disabled
@poledesfetes

24. @poledesfetes

25. I just need to identify the client-side
libraries handling the schema
@poledesfetes

26. (Part of) your schema is public.
@poledesfetes

27. What to do with the schema now?
@poledesfetes

28. @poledesfetes

29. String injections
@poledesfetes
Injecting strings can lead to:
• SQL injections
• Shell injections
• Eval injections
• XSS

30. The methods to protects against these
attacks are the same in GraphQL than any
other protocol.
@poledesfetes

31. Live demo
@poledesfetes

32. @poledesfetes

33. Wait what?
@poledesfetes

34. GraphQL object injection
@poledesfetes
GraphQL by default is not object-injectable
The custom scalar feature can be open the door to
such vulnerabilities

35. GraphQL object injection
@poledesfetes
The JSON customs scalar type is very popular.
It can be a vector for object injections.
Object injections can lead to NoSQL injections.

36. A WORD ABOUT USERS
“Authentication, Authorisation, ACL”
ME, JUST DROPPING KEYWORDS
@poledesfetes

37. It is very easy to do a mistake
@poledesfetes

38. User management mistakes
@poledesfetes
It is very tempting to make GraphQL resolvers pure in
the sense that they would be not context-aware.
Thinking this way can lead to exposing the whole user
database.

39. Anything linked to users must be checked
@poledesfetes

40. Because of the single endpoint, you can’t
do per endpoint authentication
@poledesfetes
well, you could have 2 GraphQL endpoints but…

41. All code must be user-aware
@poledesfetes

42. User-aware
@poledesfetes
For each query, you must check:
• Endpoint rights - is this user allowed to perform this
operation?
• Data-related rights - is this user allowed to access
the outcome of the operation?

43. A FEW BEST PRACTICES AND GOTCHAS
“Wait, there is a last part?”
SOMEONE WHO EXPECTED THE TALK TO BE SHORTER
@poledesfetes

44. Disable introspection
@poledesfetes

45. Limit query depth to prevent DoS
@poledesfetes

46. Enforce timeouts
@poledesfetes

47. Sit with the schema, identify anything sensitive
Log everything in the resolvers
@poledesfetes

48. Highly untrust custom scalars
@poledesfetes

49. Sqreen to release GraphQL support
@poledesfetes
Wednesday Dec 16th: Node.js
Feb 2021: Ruby
You can already use most of it

50. THANKS FOR YOUR ATTENTION!
Let’s keep in touch!
vlad@sqreen.com
@poledesfetes
@poledesfetes
I’ll share the slides on
Twitter today