GraphQL Vulnerability Could lead to Data Leakage

A vulnerability has been detected in GraphQL query language for application programming interfaces has been found to expose a leading business-to-business financial technology company.

The vulnerability was identified by researching the mobile applications and SaaS platform of the unnamed fintech provider and is said to call attention to authorization level flaws that can arise with nested queries in GraphQL.

The failure to implement authorization checks lead to submission of unauthorized transactions against any customer account and harvest any customer’s sensitive data. In this case, the GraphQL authorization flaw allowed attackers to manipulate API calls to exfiltrate sensitive user data and initiate unauthorized transactions.

The financial technology platform also introduced an additional security gap, in which some API calls accessed an API endpoint that required no authentication. The researchers could enter any transaction identifier and pull back data records of previous financial transactions.

With these two vulnerabilities, any user could extract sensitive personally identifiable information and transfer funds out of customers’ accounts without their knowledge.

The researchers note that flexibility and complexity increase the difficulty of securing GraphQL APIs. Machine assistance is said to be essential to analyse the large amounts of API telemetry data necessary to identify access control flaws and behavioural anomalies. API gateways and web application firewalls cannot protect against these attack vectors and developers cannot identify all issues without the APIs being exercised in runtime.

GraphQL provides some advantages in query options compared to REST APIs. With this flexibility, however, comes risk, since a single API call can include multiple separate queries, As GraphQL gains traction, our goal is to provide users with the intelligence, capabilities, and support to develop more secure API environments.