# GHSA-qm7x-rc44-rrqw: Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server) > Cross-site scripting in GraphQL Playground allows attackers to steal cookies and private data if the server serves the playground page. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 8 Nov 2021 ## What is GHSA-qm7x-rc44-rrqw? GHSA-qm7x-rc44-rrqw is a cross-site scripting vulnerability in apollo-server, published on 8 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. ### Official description ### Impact In certain configurations, Apollo Server serves the client-side web app "GraphQL Playground" from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations. There is a cross-site scripting vulnerability in GraphQL Playground that allows for arbitrary JavaScript code execution in your web server's origin. If a user clicks a specially crafted link to your GraphQL Playground page served by Apollo Server, an attacker can steal cookies and other private browser data. Details of the underlying GraphQL Playground vulnerability are available in [this `graphql-playground` advisory](https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7). (A [similar vulnerability](https://github.com/graphql/graphiql/security/advisories/GHSA-x4r7-m2q9-69c8) exists in the related `graphiql` project.) This advisory focuses on identifying whether *Apollo Server* installations are vulnerable and mitigating the vulnerability in Apollo Server; see the other advisories for details on the XSS vulnerability itself. The impact of this vulnerability is more severe if (as is common) your GraphQL server's origin URL is an origin that is used to store sensitive data such as cookies. In order for this vulnerability to affect your Apollo Server installation, it must actually serve GraphQL Playground. The integration between Apollo Server and GraphQL Playground is different in Apollo Server 2 and Apollo Server 3. You can tell which version of Apollo Server you are running by looking at the version of the [package from which you import the `ApolloServer` class](https://www.apollographql.com/docs/apollo-server/integrations/middleware/): this may be `apollo-server`, `apollo-server-express`, `apollo-server-lambda`, etc. #### Apollo Server 3 Apollo Server 3 does not serve GraphQL Playground by default. It has a [landing page plugin system](https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/) and the default plugin is a simple splash page that is not vulnerable to this exploit, linking to Apollo Sandbox Explorer. (We chose to change the default because GraphQL Playground is not actively maintained.) If you are running Apollo Server 3, then you are *only* vulnerable if you *explicitly* import the [`ApolloServerPluginLandingPageGraphQLPlayground`](https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#graphql-playground-landing-page) plugin and pass it to your `ApolloServer`'s constructor in the `plugins` array. Otherwise, this advisory does not apply to your server. #### Apollo Server 2 Apollo Server 2 serves GraphQL Playground by default, unless the `NODE_ENV` environment variable is set to `production`, or if you explicitly configure it via the `playground` option to the `ApolloServer` constructor. Your Apollo Server 2 installation is vulnerable if *any* of the following is true: - You pass `playground: true` to the `ApolloServer` constructor - You pass some other object like `playground: {title: "Title"}` to the `ApolloServer` constructor - You do *not* pass any `playground` option to the `ApolloServer` constructor, *and* the `NODE_ENV` environment variable is *not* set to `production` #### Apollo Server 1 Apollo Server 1 included `graphiql` instead of `graphql-playground`. `graphiql` isn't automatically enabled in Apollo Server 1: you have to explicitly call a function such as `graphiqlExpress` to enable it. Because Apollo Server 1 is not commonly used, we have not done a detailed examination of whether the integration between Apollo Server 1 and `graphiql` is vulnerable to a similar exploit. If you are still using Apollo Server 1, we recommend you disable `graphiql` by removing the `graphiqlExpress` call, and then upgrade to a newer version of Apollo Server. ### Patches and workarounds There are several approaches you can take to ensure that your server is not vulnerable to this issue. #### Upgrade Apollo Server The vulnerability has been patched in Apollo Server 2.25.3 and Apollo Server 3.4.1. To get the patch, upgrade your [Apollo Server entry point package](https://www.apollographql.com/docs/apollo-server/integrations/middleware/) to one of the fixed versions; this package may be `apollo-server`, `apollo-server-express`, `apollo-server-lambda`, etc. Additionally, if you depend directly on `apollo-server-core` in your `package.json`, make sure that you upgrade it to the same version. #### Upgrade Playground version only If upgrading to the latest version of Apollo Server 2 or 3 quickly will be challenging, you can configure your current version of Apollo Server to serve the latest version of the GraphQL Playground app. This will pin your app to serve a specific version of GraphQL Playground and you will not receive updates to it when you upgrade Apollo Server later, but this may be acceptable because GraphQL Playground is not actively maintained. The way to do this depends on what version of Apollo Server you're using and if you're already configuring GraphQL Playground. - **Apollo Server 3**: If you are using Apollo Server 3, then you are only vulnerable if your serve explicitly calls [`ApolloServerPluginLandingPageGraphQLPlayground`](https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#graphql-playground-landing-page) and passes it to the Apollo Server constructor in the `plugins` array. Add the option `version: '1.7.42'` to this call, so it looks like: ``` plugins: [ApolloServerPluginLandingPageGraphQLPlayground({version: '1.7.42'})] ``` - **Apollo Server 2 with no explicit `playground` option**: If you are using Apollo Server 2 and do not currently pass the `playground` option to `new ApolloServer`, add a `playground` option like so: ``` new ApolloServer({ playground: process.env.NODE_ENV === 'production' ? false : { version: '1.7.42' } }) ``` - **Apollo Server 2 with `playground: true` or `playground: {x, y, z}`**: If you are using Apollo Server 2 and currently pass `true` or an object to `new ApolloServer`, pass the `version` option under the `playground` option like so: ``` new ApolloServer({ playground: { version: '1.7.42', x, y, z } }) ``` #### Disable GraphQL Playground If upgrading Apollo Server or GraphQL Playground is challenging, you can also disable GraphQL Playground. In Apollo Server 3, remove the call to `ApolloServerPluginLandingPageGraphQLPlayground` from your `ApolloServer` constructor's `plugins` array. This will replace GraphQL Playground with a simple splash page. See [the landing page plugins docs](https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/) for details. In Apollo Server 2, add `playground: false` to your `ApolloServer` constructor: `new ApolloServer({ playground: false })`. This will replace GraphQL Playground with an attempt to execute a GraphQL operation, which will likely display an error in the browser. If you disable GraphQL Playground, any users who rely on it to execute GraphQL operations will need an alternative, such as the [Apollo Studio Explorer's account-free Sandbox](https://www.apollographql.com/docs/studio/explorer/#account-free-sandbox). ### Credit This vulnerability was discovered by @Ry0taK. Thank you! The fix to GraphQL Playground was developed by @acao and @glasser with help from @imolorhe, @divyenduz, and @benjie. ### For more information If you have any questions or comments about this advisory: * Read the [`graphql-playground` advisory](https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7) * Open an issue in [the `apollo-server` repo](https://github.com/apollographql/apollo-server/) * If the issue involves confidential information, email us at [security@apollographql.com](mailto:security@apollographql.com) ## Which versions are affected by GHSA-qm7x-rc44-rrqw? 4 open source packages ship an affected version, including apollo-server. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `apollo-server` | npm | From 2.0.0 | 2.25.3 | | `apollo-server` | npm | From 2.0.0 | 2.25.3 | | `apollo-server` | npm | From 3.0.0 | 3.4.1 | | `apollo-server` | npm | From 3.0.0 | 3.4.1 | ## How do I fix GHSA-qm7x-rc44-rrqw? Upgrade apollo-server to a fixed version for your release line: 2.25.3 or 3.4.1. ## Is GHSA-qm7x-rc44-rrqw being exploited? There is no known exploitation of GHSA-qm7x-rc44-rrqw in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-qm7x-rc44-rrqw and fix it if it is affected. What it is: GHSA-qm7x-rc44-rrqw is a cross-site scripting vulnerability in apollo-server, published on 8 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of GHSA-qm7x-rc44-rrqw in the wild and no public exploit code. Affected packages and fixed versions: - apollo-server (npm): affected from 2.0.0; fixed in 2.25.3 - apollo-server (npm): affected from 2.0.0; fixed in 2.25.3 - apollo-server (npm): affected from 3.0.0; fixed in 3.4.1 - apollo-server (npm): affected from 3.0.0; fixed in 3.4.1 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-qm7x-rc44-rrqw/ (Markdown: https://insights.sbomify.com/GHSA-qm7x-rc44-rrqw/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-qm7x-rc44-rrqw --- From sbomify Insights: https://insights.sbomify.com/GHSA-qm7x-rc44-rrqw/ Summaries are generated and may contain mistakes; the official description above is the record.