GHSA-74cr-77xc-8g6r Prototype Pollution in @apollo/gateway
Prototype pollution in Apollo Gateway allows attackers to alter object prototypes via GraphQL queries, potentially causing DoS or RCE.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-74cr-77xc-8g6r?
GHSA-74cr-77xc-8g6r is a vulnerability in @apollo/gateway, published on 13 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of @apollo/gateway prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.
Recommendation
Upgrade to version 0.6.2 or later.
Which versions are affected by GHSA-74cr-77xc-8g6r?
2 open source packages ship an affected version, including @apollo/gateway.
| Package | Affected | Fixed in |
|---|---|---|
@apollo/gateway npm | All versions | 0.6.2 |
@apollo/gateway npm | All versions | 0.6.2 |
How do I fix GHSA-74cr-77xc-8g6r?
Upgrade @apollo/gateway to 0.6.2 or later.
Is GHSA-74cr-77xc-8g6r being exploited?
There is no known exploitation of GHSA-74cr-77xc-8g6r in the wild and no public exploit code.