-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @apollo/composition | npm | < 2.9.5 | 2.9.5 |
| @apollo/composition | npm | >= 2.10.0-alpha.3, < 2.10.4 | 2.10.4 |
| @apollo/composition | npm | >= 2.11.0-preview.1, < 2.11.5 | 2.11.5 |
| @apollo/composition | npm | >= 2.12.0-preview.0, < 2.12.1 | 2.12.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability in Apollo Federation allowed for bypassing access control on GraphQL fields. This was due to a flaw in the composition logic, which is responsible for combining multiple subgraph schemas into a single supergraph schema. Specifically, when a field used the @requires or @fromContext directives to depend on another field that was protected by authorization directives (@authenticated, @requiresScopes, or @policy), the composition logic did not enforce that the dependent field carried the same authorization requirements.
The analysis of the patches shows that the fix involved a significant refactoring of how authorization directives are handled during composition. The key changes were made in the Merger and AuthValidator classes within composition-js/src/merging/merge.ts.
The function Merger.propagateAuthToInterfaces was part of the old, vulnerable logic and was completely removed, indicating it was a source of the problem. This function was responsible for propagating authorization requirements, but it failed to do so for transitive dependencies.
The functions AuthValidator.validateRequiresFieldSet and AuthValidator.validateFromContext are responsible for validating the authorization rules on fields with @requires and @fromContext directives, respectively. While the changes in the patch to these functions are minor, they are part of the overall fix. The main fix is in the data that these functions receive from the Merger class, which now correctly accounts for transitive dependencies thanks to the new accessControlAdditionalSources function. The vulnerability was that these validation functions were not being provided with the necessary information to detect the missing authorization on dependent fields.
Therefore, the identified functions were all part of the flawed composition and validation process that allowed the creation of a vulnerable supergraph schema. An attacker could exploit this by crafting a query that accessed protected data indirectly, bypassing the intended access control.
Merger.propagateAuthToInterfacescomposition-js/src/merging/merge.ts
AuthValidator.validateRequiresFieldSetcomposition-js/src/merging/merge.ts
AuthValidator.validateFromContextcomposition-js/src/merging/merge.ts
Ongoing coverage of React2Shell