CVE-2023-45812

Improper Check or Handling of Exceptional Conditions in apollo-router

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.

Apollo Router es un router de gráficos configurable y de alto rendimiento escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation. Las versiones afectadas están sujetas a una vulnerabilidad de tipo Denegación de Servicio (DoS) que hace que el Router entre en pánico y finalice cuando se envía una respuesta de varias partes. Cuando los usuarios envían consultas al Router que utiliza `@defer` o Suscripciones, el Router entrará en pánico. Para ser vulnerables, los usuarios de Router deben tener un coprocesador con `coprocessor.supergraph.response` configurado en su `router.yaml` y también admitir `@defer` o Suscripciones. La versión 1.33.0 de Apollo Router tiene una solución para esta vulnerabilidad que se introdujo en el PR #4014. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben evitar el uso de la respuesta supergraph del coprocesador o desactivar el soporte de aplazamiento y suscripciones y continuar usando la respuesta supergraph del coprocesador.

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-10-13 CVE Reserved
2023-10-18 CVE Published
2024-09-13 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-754: Improper Check for Unusual or Exceptional Conditions

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/apollographql/router/pull/4014	2023-10-30

URL	Date	SRC
https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj	2023-10-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apollographql Search vendor "Apollographql"		Apollo Router Search vendor "Apollographql" for product "Apollo Router"				>= 1.31.0 <= 1.32.0 Search vendor "Apollographql" for product "Apollo Router" and version " >= 1.31.0 <= 1.32.0"		-		Affected
Apollographql Search vendor "Apollographql"		Apollo Helms-charts Router Search vendor "Apollographql" for product "Apollo Helms-charts Router"				>= 1.31.0 <= 1.32.0 Search vendor "Apollographql" for product "Apollo Helms-charts Router" and version " >= 1.31.0 <= 1.32.0"		-		Affected