APIsecure 2023 - The world's first and only API security conference March 14 & 15, 2023 Escape Workshop: "Discovering GraphQL Vulnerabilities in the Wild" Tristan Kalos, Co-founder & CEO at Escape Antoine Carossio, Co-founder & CTO at Escape ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. Live GraphQL Security Testing
escape.tech
Discovering GraphQL Vulnerabilities in the Wild

2. Who Am I
Tristan Kalos
Co-founder & CEO @ Escape – GraphQL Security
󰏃 + 󰎆󰑔󰎼
󰞼 Engineer in Operations Research & 󰛻 MBA
󰳕 Researcher in Machine Learning Applied to Source Code
🛠 Loved GraphQL but struggled to secure it
✉
tristan@escape.tech
@tristankalos

3. About Escape - GraphQL Security
We created the first fully-featured automated GraphQL Security Testing tool & have an in-house
research team on the topic.
https://app.escape.tech/

4. What is GraphQL?

5. GraphQL is a query language for APIs

6. The anatomy of a GraphQL request
Operations
Fields
Directives
Parameters
Aliases
Batches
Fragments
Query Depth
Query
Width

7. Why is GraphQL vulnerable?
1 - GraphQL is a full-featured language, leaving more space for malicious requests

8. Why is GraphQL Vulnerable?
2 - GraphQL is a graph, prone to access control problems

9. Discovering GraphQL Vulnerabilities in the Wild

10. 1. Finding GraphQL endpoints in the internet
2. Testing endpoints for advanced security flaws
3. Our results

11. How to find public GraphQL endpoints on the internet?
Step 1: buy a cheap list of domains

12. How to find public GraphQL endpoints on the internet?
Step 2: use our open source GraphQL endpoint finder
https://github.com/Escape-Technologies/goctopus

13. How to find public GraphQL endpoints on the internet?
But….
We have 1.2M domains. It’s too slow.
https://github.com/Escape-Technologies/graphinder

14. How to find public GraphQL endpoints on the internet?
Step 3: Make a faster version, in golang.
https://github.com/Escape-Technologies/goctopus
We now have 2449 public
GraphQL endpoints

15. 2. Testing endpoints for advanced security flaws

16. The two problems when testing GraphQL APIs
Problem 1: It’s hard to automate API testing.

17. The two problems when testing GraphQL APIs
Solution 1 : Feedback driven API Exploration

18. The two problems when testing GraphQL APIs
Solution 1 : Feedback driven API Exploration

19. The two problems when testing GraphQL APIs
Problem 2 : GraphQL is a Graph
1. stripe_token

20. The two problems when testing GraphQL APIs
Solution 2 : Recursively explore all paths in the graph
1. stripe_token

21. Now, what to test?
https://docs.escape.tech/advanced-usage/security_tests

22. Now, what to test?
● Rate limits
https://docs.escape.tech/advanced-usage/security_tests

23. Now, what to test?
● Rate limits
● Query size limits
https://docs.escape.tech/advanced-usage/security_tests

24. Now, what to test?
● Rate limits
● Query size limits
● BOLA (Broken Object Level Authorization)
https://docs.escape.tech/advanced-usage/security_tests

25. Now, what to test?
● Rate limits
● Query size limits
● BOLA (Broken Object Level Authorization)
● HTTP Errors (500 errors, SSL/TLS)
https://docs.escape.tech/advanced-usage/security_tests

26. Now, what to test?
● Rate limits
● Query size limits
● BOLA (Broken Object Level Authorization)
● HTTP Errors (500 errors, SSL/TLS)
● Information Disclosure (Server version, Stack traces)
https://docs.escape.tech/advanced-usage/security_tests

27. Now, what to test?
● Rate limits
● Query size limits
● BOLA (Broken Object Level Authorization)
● HTTP Errors (500 errors, SSL/TLS)
● Information Disclosure (Server version, Stack traces)
● Request Forgery
https://docs.escape.tech/advanced-usage/security_tests

28. Now, what to test?
● Rate limits
● Query size limits
● BOLA (Broken Object Level Authorization)
● HTTP Errors (500 errors, SSL/TLS)
● Information Disclosure (Server version, Stack traces)
● Request Forgery
● Injections
https://docs.escape.tech/advanced-usage/security_tests

29. Now, what to test?
● Rate limits
● Query size limits
● BOLA (Broken Object Level Authorization)
● HTTP Errors (500 errors, SSL/TLS)
● Information Disclosure (Server version, Stack traces)
● Request Forgery
● Injections
● Sensitive Data Leaks
https://docs.escape.tech/advanced-usage/security_tests

30. 3. Results analysis

31. 1,599
Endpoints scanned

32. 1,599
Endpoints scanned
416
cumulative scan hours

33. 1,599
Endpoints scanned
416
cumulative scan hours
46,809
security alerts raised

34. How many alerts per application?

35. Which severity and type?

36. Breaking down vulnerabilities (1/2)

37. Breaking down vulnerabilities (2/2)

38. Top vulnerabilities: mostly GraphQL Specific

39. Top vulnerability 1: Limit Batching and Aliasing
Batching: Multiple GraphQL
Queries in one HTTP Request
Aliasing: The same fields multiple
times with aliases

40. Top vulnerability 1: Limit Batching and Aliasing
The problem: can be used to bypass rate limiting on login mutations = Bruteforce attack

41. Top vulnerability 2: Directive Overloading
The problem: Directives are hard to process server side. Can be used to trigger DoS
150ms
100kb request 1 min

42. Top vulnerability 3: Recursive Fragments
Fragments: a piece of logic that can be shared between multiple queries

43. Top vulnerability 3: Recursive Fragments
The problem: What if a fragment calls itself? Oops, you got an infinite recursion.

44. Top vulnerability 4: Field suggestion schema leak
The problem: Endpoints with disabled introspection still leaks underlying API Schema through field
suggestion

45. No introspection? Disable field suggestion
The problem: Endpoints with disabled introspection still leaks underlying API Schema through field
suggestion
using open source tool Clairvoyance, anybody can build back the full Schema.

46. Summary about common GraphQL vulnerabilities:
1. Batching and Aliasing Attacks
2. Directive Overloading
3. Recursive Fragments
4. Field suggestion leaking Schema
To go further:
https:/
/escape.tech/blog/pentest101/

47. Bonus: Sensitive data made public

48. 4,493 potential data leaks found.

49. Sensitive data found in the wild

50. All this, using unauthenticated GET requests

51. Conclusion:
● found and scanned 1500 Public GraphQL
endpoints in the wild
● Highlighted numerous vulnerabilities, most
frequently GraphQL Specific, but not only
● Access control flaws and secret leaking are *very*
frequent in GraphQL

52. Thanks for listening!

53. GraphQL Security & Monitoring
escape.tech
✉ tristan@escape.tech
@tristankalos