CVE-2023-34047: Spring for GraphQL Exposed to GraphQL Context with Values from Different Session
Summary
CVE-2023-34047: Spring for GraphQL may be exposed to GraphQL context with values from a different session. Affects org.springframework.graphql:spring-graphql across 2 version ranges.
>= 1.1.0, < 1.1.6
>= 1.2.0, < 1.2.3
Fixed in 1.1.6 or 1.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring for GraphQL is a library that provides support for building GraphQL APIs in Spring Boot applications. It allows developers to define GraphQL schemas, resolvers, and data loaders to handle GraphQL queries and mutations. The library integrates with Spring Security to provide authentication and authorization capabilities. However, versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 of Spring for GraphQL are vulnerable to a security issue.
Vulnerability Detail
The vulnerability in Spring for GraphQL arises from a batch loader function that may be exposed to GraphQL context with values from a different session. This means that an attacker could potentially access GraphQL context values, including security context values, from another user's session. This could lead to unauthorized access to sensitive data or actions. The vulnerability affects applications that provide a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.1.0, < 1.1.61.1.6 -
>= 1.2.0, < 1.2.31.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of Spring for GraphQL.
Conclusion
The vulnerability in Spring for GraphQL can be mitigated by upgrading to the fixed versions of the library. It is important to promptly apply the fix to ensure the security of the application and protect against potential unauthorized access to sensitive data or actions. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.springframework.graphql:spring-graphql →
FAQ
Spring for GraphQL is a library that provides support for building GraphQL APIs in Spring Boot applications.
Versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 of Spring for GraphQL are affected.
The vulnerability could allow an attacker to access GraphQL context values, including security context values, from a different session, potentially leading to unauthorized access to sensitive data or actions.
To fix this vulnerability, you should upgrade to the fixed versions of Spring for GraphQL (1.1.6 or 1.2.3). Update the library dependency in your project's Maven or Gradle configuration and thoroughly test the application after the update.
No specific workaround is mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of Spring for GraphQL.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.graphql:spring-graphql.
