# GHSA-8r69-3cvp-wxc3: Batched HTTP requests may set incorrect `cache-control` response header > Apollo Server may incorrectly cache sensitive data from batched GraphQL requests, allowing unauthorized access via CDN or browser caches. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 2 Nov 2022 ## What is GHSA-8r69-3cvp-wxc3? GHSA-8r69-3cvp-wxc3 is a vulnerability in @apollo/server, published on 2 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description ### Impact In Apollo Server 3 and 4, the `cache-control` HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server allows clients to send multiple operations in a single HTTP request. The results of these operations are returned in a single HTTP response, with a single set of headers. Apollo Client Web and Apollo Kotlin both have opt-in features to use batched requests. Apollo Server has several features relating to caching. This advisory is about the ability to set the `cache-control` response header based on field- and operation-specific cache hints. (It is not about the "response cache plugin".) This header can be interpreted by a reverse proxy such as a CDN in front of your server, or by a browser. In Apollo Server 2, plugins such as the cache control plugin could not control the HTTP headers of responses to batch requests. This meant that batch requests never got the `cache-control` response header. In Apollo Server 3 and 4, plugins can set HTTP response headers. But for batched requests, plugins essentially assemble a separate set of response headers in parallel for each operation, and then the header sets are merged together. If plugins set the same header on multiple operations, one value is chosen arbitrarily. This meant that if a client sent a batched HTTP request with two operations with different cache policies, Apollo Server 3 and 4 would return a `cache-control` header that only applies to one of the operations. If one operation is allowed to be cached and the other operation is not allowed to be cached, the full response including both results could still end up being cached in a CDN or other reverse proxy cache. Note that valid batched requests must be POST requests. (There's no defined format for sending batched requests over GET.) So in order for this incorrect `cache-control` header to have a harmful effect, a cache must allow caching POST requests. This means this bug is unlikely to cause incorrect caching in browser or mobile client caches, or in many reverse proxy/CDN caches. This issue could lead to cache poisoning attacks. For example, if a client app regularly sends an operation that should not be cached due to its dependency on session-specific information in the same HTTP request as an operation that can be cached in a shared cache, an attacker could send its own version of the request to the server and manage to get the response to its request stored in the shared cache; other users would then see the response specific to the attacker for the first operation rather than the response for their own session. That said, we expect that in a system where this cache poisoning attack is feasible, normal operation would also run into the issue and users may have already disabled one of the features in order for their system to function properly. ### Patches This issue is patched in Apollo Server v3.11.0 and v4.1.0. The issue resolved differently in the two versions. If you are using Apollo Server 3, upgrade the package you depend on (eg `apollo-server` or `apollo-server-express`) to v3.11.0. This will restore the Apollo Server 2 behavior where the cache control plugin *never* sets the `cache-control` HTTP response header on batched requests. (Other cache-related features, like the response cache plugin, still function.) If you are using Apollo Server 4, upgrade `@apollo/server` to v4.1.0. This upgrade makes the response HTTP header object seen by plugins shared among all plugins processing *all operations* on a request, and makes the cache control plugin merge `cache-control` header values across operations in a request. (Note that if you set the `cache-control` response header in your own plugin, Apollo Server v4.1.0's cache control plugin will not try to overwrite the value you set.) ### Workarounds As a workaround, you can disable either the HTTP batching feature or the `cache-control` header feature. To disable HTTP batching in Apollo Server 3 (v3.5.0 or newer), pass `allowBatchedHttpRequests: false` to `new ApolloServer`.This is the default behavior for Apollo Server 4; in AS4, just make sure you're not passing `allowBatchedHttpRequests: true`. (You cannot disable batching in versions of Apollo Server 3 older than v3.5.0.) To disable the `cache-control` header feature, add `ApolloServerPluginCacheControl({ calculateHttpHeaders: false })` to the `plugins` list in `new ApolloServer()`. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the `apollo-server` repository](https://github.com/apollographql/apollo-server) * Email us at [security@apollographql.com](mailto:security@apollographql.com) ## Which versions are affected by GHSA-8r69-3cvp-wxc3? 4 open source packages ship an affected version, including @apollo/server and apollo-server-core. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `@apollo/server` | npm | All versions | 4.1.0 | | `@apollo/server` | npm | All versions | 4.1.0 | | `apollo-server-core` | npm | From 3.0.0 | 3.11.0 | | `apollo-server-core` | npm | From 3.0.0 | 3.11.0 | ## How do I fix GHSA-8r69-3cvp-wxc3? Upgrade @apollo/server to 4.1.0 or later. ## Is GHSA-8r69-3cvp-wxc3 being exploited? There is no known exploitation of GHSA-8r69-3cvp-wxc3 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-8r69-3cvp-wxc3 and fix it if it is affected. What it is: GHSA-8r69-3cvp-wxc3 is a vulnerability in @apollo/server, published on 2 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-8r69-3cvp-wxc3 in the wild and no public exploit code. Affected packages and fixed versions: - @apollo/server (npm): affected all versions; fixed in 4.1.0 - @apollo/server (npm): affected all versions; fixed in 4.1.0 - apollo-server-core (npm): affected from 3.0.0; fixed in 3.11.0 - apollo-server-core (npm): affected from 3.0.0; fixed in 3.11.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-8r69-3cvp-wxc3/ (Markdown: https://insights.sbomify.com/GHSA-8r69-3cvp-wxc3/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-8r69-3cvp-wxc3 --- From sbomify Insights: https://insights.sbomify.com/GHSA-8r69-3cvp-wxc3/ Summaries are generated and may contain mistakes; the official description above is the record.