# GHSA-w42g-7vfc-xf37: Introspection in schema validation in Apollo Server > Apollo Server fails to enforce validation rules on WebSocket subscriptions, allowing bypass of security controls if subscriptions are enabled. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 5 Jun 2020 ## What is GHSA-w42g-7vfc-xf37? GHSA-w42g-7vfc-xf37 is a vulnerability in apollo-server, published on 5 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The _Resolution_ section contains details on patched versions. ### Impact If `subscriptions: false` is passed to the `ApolloServer` constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport **and** are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If `introspection: true` is passed to the `ApolloServer` constructor options, the impact is limited to user-provided validation rules (i.e., using `validationRules`) since there would be no expectation that introspection was disabled. The enforcement of user-provided validation rules on the HTTP transport is working as intended and is unaffected by this advisory. Similarly, disabling introspection on the HTTP transport is working as intended and is unaffected by this advisory. > **Note:** Unless `subscriptions: false` is explicitly passed to the constructor parameters of `new ApolloServer({ ... })`, **subscriptions are enabled by default, whether or not there is a `Subscription` type present in the schema.** As an alternative to upgrading to a patched version, see the _Workarounds_ section below to disable subscriptions if it is not necessary. In cases where `subscriptions: false` is **not** explicitly set, the subscription server **is impacted** since validation rules which are enforced on the main request pipeline within Apollo Server were not being passed to the `SubscriptionServer.create` invocation ([seen here, prior to the patch](https://github.com/apollographql/apollo-server/blob/7d6f23443e52a90deb74f152f34bb76eea78ee19/packages/apollo-server-core/src/ApolloServer.ts#L677-L726)). The omitted validation rules for the subscription server include any `validationRules` passed by implementors to the `ApolloServer` constructor which were expected to be enforced on the subscriptions WebSocket endpoint. **Additionally**, because an internal [`NoIntrospection`](https://github.com/apollographql/apollo-server/blob/7d6f23443/packages/apollo-server-core/src/ApolloServer.ts#L77-L88) validation rule is used to disable introspection, it would have been possible to introspect a server on the WebSocket endpoint that the `SubscriptionServer` creates even though it was not possible on other transports (e.g. HTTP). **The severity of risk depends on whether sensitive information is being stored in the schema itself.** The contents of schema descriptions, or secrets which might be revealed by the names of types or field names within those types, will determine the risk to individual implementors. ### Affected packages The bug existed in `apollo-server-core` versions prior to version 2.14.2, however, this means all integration packages (e.g., `apollo-server-express`, etc.) prior to version 2.14.2 which depend on `apollo-server-core` for their subscriptions support are affected. This includes the `apollo-server` package that automatically provides an Express server. Therefore, for officially published Apollo Server packages, the full list of affected packages includes: `apollo-server`, `apollo-server-azure-functions`, `apollo-server-cache-memcached`, `apollo-server-core`, `apollo-server-cloud-functions`, `apollo-server-cloudflare`, `apollo-server-express`, `apollo-server-fastify`, `apollo-server-hapi`, `apollo-server-koa`, `apollo-server-lambda`, and `apollo-server-micro`. > Note: The full list included here doesn't fit into the box provided by the GitHub Security Advisories form. ### Resolution The problem is resolved in Apollo Server versions 2.14.2 or higher. If upgrading is not an option, see _Workarounds_ below. When upgrading, ensure that the affected integration package (e.g., `apollo-server-express`) **and** the `apollo-server-core` package are both updated to the patched versions. (The version numbers should both be 2.14.2.) ### Workarounds Upgrading to a patched version is the recommended solution. If upgrading is not an option, subscriptions can be disabled with `subscriptions: false` to resolve the impact. **Disabling subscriptions in this way will disable _all_ subscriptions support and the WebSocket transport**: ```js const server = new ApolloServer({ subscriptions: false, /* Other options, such as typeDefs, resolvers, schema, etc. */ }); ``` ### For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/apollographql/apollo-server/issues/new) and the maintainers will try to assist. ### Credit and appreciation Apollo fully believes in ethical disclosure of vulnerabilities by security researchers who notify us with details and provide us time to address and fix the issues before publicly disclosing. Credit for this discovery goes to the team at [Bitwala](https://www.bitwala.com/), who reported the concern to us responsibly after discovering it during their own auditing. ## Which versions are affected by GHSA-w42g-7vfc-xf37? 24 open source packages ship an affected version, including apollo-server, apollo-server-azure-functions and apollo-server-cache-memcached. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `apollo-server` | npm | All versions | 2.14.2 | | `apollo-server` | npm | All versions | 2.14.2 | | `apollo-server-azure-functions` | npm | All versions | 2.14.2 | | `apollo-server-azure-functions` | npm | All versions | 2.14.2 | | `apollo-server-cache-memcached` | npm | All versions | 2.14.2 | | `apollo-server-cache-memcached` | npm | All versions | 2.14.2 | | `apollo-server-cloud-functions` | npm | All versions | 2.14.2 | | `apollo-server-cloud-functions` | npm | All versions | 2.14.2 | | `apollo-server-cloudflare` | npm | All versions | 2.14.2 | | `apollo-server-cloudflare` | npm | All versions | 2.14.2 | | `apollo-server-core` | npm | All versions | 2.14.2 | | `apollo-server-core` | npm | All versions | 2.14.2 | | `apollo-server-express` | npm | All versions | 2.14.2 | | `apollo-server-express` | npm | All versions | 2.14.2 | | `apollo-server-fastify` | npm | All versions | 2.14.2 | | `apollo-server-fastify` | npm | All versions | 2.14.2 | | `apollo-server-hapi` | npm | All versions | 2.14.2 | | `apollo-server-hapi` | npm | All versions | 2.14.2 | | `apollo-server-koa` | npm | All versions | 2.14.2 | | `apollo-server-koa` | npm | All versions | 2.14.2 | | `apollo-server-lambda` | npm | All versions | 2.14.2 | | `apollo-server-lambda` | npm | All versions | 2.14.2 | | `apollo-server-micro` | npm | All versions | 2.14.2 | | `apollo-server-micro` | npm | All versions | 2.14.2 | ## How do I fix GHSA-w42g-7vfc-xf37? Upgrade apollo-server to 2.14.2 or later. ## Is GHSA-w42g-7vfc-xf37 being exploited? There is no known exploitation of GHSA-w42g-7vfc-xf37 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-w42g-7vfc-xf37 and fix it if it is affected. What it is: GHSA-w42g-7vfc-xf37 is a vulnerability in apollo-server, published on 5 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-w42g-7vfc-xf37 in the wild and no public exploit code. Affected packages and fixed versions: - apollo-server (npm): affected all versions; fixed in 2.14.2 - apollo-server (npm): affected all versions; fixed in 2.14.2 - apollo-server-azure-functions (npm): affected all versions; fixed in 2.14.2 - apollo-server-azure-functions (npm): affected all versions; fixed in 2.14.2 - apollo-server-cache-memcached (npm): affected all versions; fixed in 2.14.2 - apollo-server-cache-memcached (npm): affected all versions; fixed in 2.14.2 - apollo-server-cloud-functions (npm): affected all versions; fixed in 2.14.2 - apollo-server-cloud-functions (npm): affected all versions; fixed in 2.14.2 - apollo-server-cloudflare (npm): affected all versions; fixed in 2.14.2 - apollo-server-cloudflare (npm): affected all versions; fixed in 2.14.2 - apollo-server-core (npm): affected all versions; fixed in 2.14.2 - apollo-server-core (npm): affected all versions; fixed in 2.14.2 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-w42g-7vfc-xf37/ (Markdown: https://insights.sbomify.com/GHSA-w42g-7vfc-xf37/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-w42g-7vfc-xf37 --- From sbomify Insights: https://insights.sbomify.com/GHSA-w42g-7vfc-xf37/ Summaries are generated and may contain mistakes; the official description above is the record.