INTERFACE by apidays 2023 APIs for a “Smart” economy. Embedding AI to deliver Smart APIs and turn into an exponential organization June 28 & 29, 2023 Production Ready GraphQL Antoine Carossio, Cofounder CTO at Escape Tristan Kalos, Cofounder CEO at Escape ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. /46
Modern Application Security
GraphQL Vulnerabilities in the Wild
What scanning real-life GraphQL apps told us about
Securing GraphQL in Production
1

3. /46
About Escape
First automated Security Testing platform able to test the business logic of APIs and GraphQL.
https://app.escape.tech/ 2

4. /46
1599
production APIs scanned
3

5. /46
1599
production APIs scanned
416
cumulative scan hours
4

6. /46
1599
production APIs scanned
416
cumulative scan hours
5
46,809
security alerts found

7. /46
30
security alerts per GraphQL app on average
6

8. /46
Tristan Kalos
Co-founder & CEO
✉ tristan@escape.tech
🐣 @tristankalos
Antoine Carossio
Co-founder & CTO
✉ antoine@escape.tech
🐣 @iCarossio
7
https://escape.tech/resources/state-of-graphql-security-2023/

9. /46
Why is GraphQL vulnerable?
8

10. /46
GraphQL is a query language for APIs
9

11. /46
Why is GraphQL vulnerable?
1 – GraphQL is a full-featured language…
10

12. /46
Why is GraphQL vulnerable?
1 – GraphQL is a full-featured language…
11
Operations
Fields
Directives
Parameters
Aliases
Batches
Fragments
Query Depth
Query Width

13. /46
Why is GraphQL vulnerable?
2 - GraphQL is a graph… with a lot of different paths leading to the same resource
12

14. /46
Why is GraphQL vulnerable?
1. stripe_token
2 - GraphQL is a graph… with a lot of different paths leading to the same resource
13

15. /46
Why is GraphQL vulnerable?
1. stripe_token
2 - GraphQL is a graph… with a lot of different paths leading to the same resource
14

16. /46
Why is GraphQL vulnerable?
1. stripe_token
2 - GraphQL is a graph… with a lot of different paths leading to the same resource
Access control is a nightmare!
15

17. /46
Why is is hard to test production GraphQL apps?
16

18. /46
The two problems when testing GraphQL APIs
Problem 1 : Classic testing cannot assess the business logic of APIs
17

19. /46
The two problems when testing GraphQL APIs
> Solution 1 : Feedback-Driven API Exploration
18

20. /46
The two problems when testing GraphQL APIs
> Solution 1 : Feedback-Driven API Exploration
19

21. /46
The two problems when testing GraphQL APIs
Problem 2 : GraphQL is a Graph…
1. stripe_token
20

22. /46
The two problems when testing GraphQL APIs
> Solution 2 : Recursively explore all paths in the graph
1. stripe_token
21

23. /46
The findings
22

24. /46
46,809
security alerts found
23

25. /46
Which severity and category?
24

26. /46
Which severity and category?
25
API:01
API:02
API:03
API:05
API:04
API:06
API:07
API:04 API:07
API:10
API:09
2019:08

27. /46
Which severity and category?
26
API:01
API:02
API:03
API:05
API:04
API:06
API:07
API:04 API:07
API:10
API:09
2019:08

28. /46
A lot are GraphQL-specific
27

29. /46
GraphQL-specific Vulnerabilities come first
28

30. /46
Top vulnerability 1: Bruteforcing API requests (API:04)
Batching: Multiple GraphQL
Queries in one HTTP Request
Aliasing: The same fields multiple
times with aliases
29

31. /46
Top vulnerability 1: Bruteforcing API requests (API:04)
The problem: can be used to bypass rate limiting on login mutations = Bruteforce attack
30

32. /46
Top vulnerability 2: Denial of Service (API:04)
Fragments: a piece of logic that can be shared between multiple queries
31

33. /46
Top vulnerability 2: Denial of Service (API:04)
The problem: What if a fragment calls itself? Oops, you got an infinite recursion.
32

34. /46
Top vulnerability 3: Internal API Schema Leak (API:07)
The problem: Endpoints with disabled introspection still leaks underlying schema through field suggestio
33

35. /46
Top vulnerability 3: Internal API Schema Leak (API:07)
The problem: Endpoints with disabled introspection still leaks underlying API Schema through field
suggestion using open source tool Clairvoyance, anybody can build back the full Schema.
34

36. /46
Classic API vulnerabilities are still there
35

37. /46
HTTP Errors, Access Control Issues, Injections
36

38. /46
API Errors and Stacktraces disclosing internal data (API:07)
The problem: Stack Traces give too much information on what’s vulnerable in your app 👀
(12% endpoints misconfigured)
37

39. /46
Access Control issues (API:01,02,03,05)
The problem:
Most routes writing data (mutations) are not supposed to be accessible without authentication
38

40. /46
Injections are still there (API2019:08)
● 16 SQL or NoSQL injections
● 1 bash command injection
● 3 Server Side Request Forgery
39

41. /46
VI. Sensitive data made public!
40

42. /46
4,493 potential PII and token leaks found.
41

43. /46
4,493 potential PII and token leaks found.
• Emails
• Phone numbers
• Passport numbers
• Bank Account numbers
42

44. /46
4,493 potential PII and token leaks found.
• API Keys: AWS, GCP
• Private RSA Keys
• Auth Tokens: Adobe, Asana, Github…
43

45. /46
44
● DOS & Complexity issues:
○ API04: Unrestricted Resource Consumption
< Due to GraphQL-specific features
● Access Control, Authentication and Authorization:
○ API01: Broken Object Level Authorization (BOLA)
○ API02: Broken Authentication
○ API03: Broken Object Property Level Authorization
(BOPLA)
○ API05: Broken Function Level Authorization (BFLA)
< Very common because of the graph
nature of GraphQL
● Security Misconfiguration and Information Disclosure
○ API07: Security Misconfiguration
< Federated GraphQL apps often forget to
catch error messages from underlying APIs
< Development features enabled in prod
How does OWASP TOP 10 reflect in prod-ready GraphQL apps?

46. /46
Conclusion, using unauthenticated API calls:
● We found 130k+ public GraphQL APIs into the wild and scanned 1599
of them
● Highlighted numerous vulnerabilities, most frequently GraphQL
Specific, but not only
● Access control flaws and secret leaks are *very* frequent in GraphQL
45

47. /46
Tristan Kalos
Co-founder & CEO
✉ tristan@escape.tech
🐣 @tristankalos
Antoine Carossio
Co-founder & CTO
✉ antoine@escape.tech
🐣 @iCarossio
46/4
7
https://escape.tech/resources/state-of-graphql-security-2023/