apidays LIVE Paris - GraphQL: the AppSec perspective by Vladimir de Turckheim
•
0 j'aime•224 vues
apidays LIVE Paris - Responding to the New Normal with APIs for Business, People and Society December 8, 9 & 10, 2020 GraphQL: the AppSec perspective Vladimir de Turckheim, Lead Node.js Engineer at Sqreen
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à apidays LIVE Paris - GraphQL: the AppSec perspective by Vladimir de Turckheim
Similaire à apidays LIVE Paris - GraphQL: the AppSec perspective by Vladimir de Turckheim (20)
Plus de apidays
Plus de apidays (20)
Dernier
Dernier (20)
apidays LIVE Paris - GraphQL: the AppSec perspective by Vladimir de Turckheim
- 1. GraphQL the AppSec perspective 2020-12 Get your white hat ready
- 2. VLADIMIR DE TURCKHEIM Lead Customer Engineer @ Sqreen : Node.js Collaborator : Node.js Security WG member : Former Cyber-Security consultant @vdeturckheim vladimir@sqreen.io @poledesfetes
- 3. I AM NOT A GRAPHQL EXPERT “booooo!” MY IMPOSTOR SYNDROME @poledesfetes
- 4. I do Web Application security @poledesfetes
- 7. I am also a developer @poledesfetes
- 8. GraphQL is just “another way to exchange data between a client and a server” @poledesfetes
- 9. As any abstraction, it is designed to make your life easier! @poledesfetes
- 10. But abstractions can make you forget about @poledesfetes implementation details
- 11. But abstractions can make you forget about @poledesfetes implementation details
- 13. @poledesfetes implementation details This is where the fun is!
- 14. But I am going too fast @poledesfetes
- 15. HOW WOULD ONE ATTACK A GRAPHQL APP? “Why is my hat turning grey?” NICE HACKERS @poledesfetes
- 16. Identifying that the application is using GraphQL @poledesfetes
- 17. @poledesfetes
- 18. Identifying use of GraphQL @poledesfetes Applications using GraphQL can easily be identified • Use of GraphQL-related libraries • POST requests to a /graphql endpoint • POST requests with GraphQL payloads
- 21. Abusing Introspection @poledesfetes GraphQL has introspection features. A simple query can be used to identify the schema
- 23. Introspection might be disabled @poledesfetes
- 24. @poledesfetes
- 25. I just need to identify the client-side libraries handling the schema @poledesfetes
- 26. (Part of) your schema is public. @poledesfetes
- 27. What to do with the schema now? @poledesfetes
- 28. @poledesfetes
- 29. String injections @poledesfetes Injecting strings can lead to: • SQL injections • Shell injections • Eval injections • XSS
- 30. The methods to protects against these attacks are the same in GraphQL than any other protocol. @poledesfetes
- 32. @poledesfetes
- 34. GraphQL object injection @poledesfetes GraphQL by default is not object-injectable The custom scalar feature can be open the door to such vulnerabilities
- 35. GraphQL object injection @poledesfetes The JSON customs scalar type is very popular. It can be a vector for object injections. Object injections can lead to NoSQL injections.
- 36. A WORD ABOUT USERS “Authentication, Authorisation, ACL” ME, JUST DROPPING KEYWORDS @poledesfetes
- 37. It is very easy to do a mistake @poledesfetes
- 38. User management mistakes @poledesfetes It is very tempting to make GraphQL resolvers pure in the sense that they would be not context-aware. Thinking this way can lead to exposing the whole user database.
- 39. Anything linked to users must be checked @poledesfetes
- 40. Because of the single endpoint, you can’t do per endpoint authentication @poledesfetes well, you could have 2 GraphQL endpoints but…
- 41. All code must be user-aware @poledesfetes
- 42. User-aware @poledesfetes For each query, you must check: • Endpoint rights - is this user allowed to perform this operation? • Data-related rights - is this user allowed to access the outcome of the operation?
- 43. A FEW BEST PRACTICES AND GOTCHAS “Wait, there is a last part?” SOMEONE WHO EXPECTED THE TALK TO BE SHORTER @poledesfetes
- 45. Limit query depth to prevent DoS @poledesfetes
- 47. Sit with the schema, identify anything sensitive Log everything in the resolvers @poledesfetes
- 48. Highly untrust custom scalars @poledesfetes
- 49. Sqreen to release GraphQL support @poledesfetes Wednesday Dec 16th: Node.js Feb 2021: Ruby You can already use most of it
- 50. THANKS FOR YOUR ATTENTION! Let’s keep in touch! vlad@sqreen.com @poledesfetes @poledesfetes I’ll share the slides on Twitter today