Description
Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hasura | Hasura GraphQL | 1.3.3 | — |
References
- ExploitDB-49791 exploit
- Hasura GraphQL Engine GitHub Repository product
- VulnCheck Advisory: Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection third-party-advisory