CVE-2024-28101
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.
Apollo Router es un router de gráficos escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation. Las versiones 0.9.5 hasta 1.40.2 están sujetas a una vulnerabilidad de tipo Denegación de servicio (DoS). Al recibir payloads HTTP comprimidos, las versiones afectadas del router evalúan la opción de configuración `limits.http_max_request_bytes` después de descomprimir el payload comprimido en su totalidad. Si las versiones afectadas del router reciben payloads altamente comprimidos, esto podría resultar en un consumo significativo de memoria mientras se expande el payload comprimido. La versión 1.40.2 del router tiene una solución para la vulnerabilidad. Aquellos que no puedan actualizar pueden implementar mitigaciones en servidores proxy o balanceadores de carga ubicados frente a su flota de router (por ejemplo, Nginx, HAProxy o servicios WAF nativos de la nube) creando límites en el tamaño de carga del cuerpo HTTP.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-03-04 CVE Reserved
- 2024-03-06 CVE Published
- 2024-03-07 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413 | X_refsource_misc | |
| https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apollographql Search vendor "Apollographql" | Router Search vendor "Apollographql" for product "Router" | >= 0.9.5 < 1.40.2 Search vendor "Apollographql" for product "Router" and version " >= 0.9.5 < 1.40.2" | en |
Affected
| ||||||