Description
Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hasura | Hasura GraphQL | 1.3.3 | — |
References
- ExploitDB-49790 exploit
- Hasura GraphQL Engine GitHub Repository product
- VulnCheck Advisory: Hasura GraphQL 1.3.3 Local File Read via SQL Injection third-party-advisory