CVE-2021-41249 XSS vulnerability in GraphQL Playground

2021-11-0420:05:12

CWE-79

GitHub_M

www.cve.org

cve-2021-41249

xss vulnerability

graphql playground

upgrade

[email protected]

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

AI Score

Confidence

High

EPSS

0.001

Percentile

32.7%

JSON

GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user’s browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.

CNA Affected

[
  {
    "product": "graphql-playground",
    "vendor": "graphql",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.7.28"
      }
    ]
  }
]