cvelistv5 - cve-2023-45812

CVE-2023-45812 (GCVE-0-2023-45812)

Vulnerability from cvelistv5 – Published: 2023-10-18 21:29 – Updated: 2024-09-13 15:02

Summary

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M

References

URL

Tags

	https://github.com/apollographql/router/security/…	x_refsource_CONFIRM
	https://github.com/apollographql/router/pull/4014	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	apollographql	router	Affected: >= 1.31.0, < 1.33.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:29:32.278Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
          },
          {
            "name": "https://github.com/apollographql/router/pull/4014",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apollographql/router/pull/4014"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apollographql:apollo_router:1.31.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "apollo_router",
            "vendor": "apollographql",
            "versions": [
              {
                "lessThanOrEqual": "1.33.0",
                "status": "affected",
                "version": "1.31.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-45812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-13T14:58:32.929626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-13T15:02:17.414Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "router",
          "vendor": "apollographql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.31.0, \u003c 1.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-18T21:29:32.731Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
        },
        {
          "name": "https://github.com/apollographql/router/pull/4014",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apollographql/router/pull/4014"
        }
      ],
      "source": {
        "advisory": "GHSA-r344-xw3p-2frj",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Check or Handling of Exceptional Conditions in apollo-router"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-45812",
    "datePublished": "2023-10-18T21:29:32.731Z",
    "dateReserved": "2023-10-13T12:00:50.437Z",
    "dateUpdated": "2024-09-13T15:02:17.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.31.0\", \"versionEndIncluding\": \"1.32.0\", \"matchCriteriaId\": \"E5CBFBBF-CA05-439F-B7D9-0F0160C90006\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apollographql:apollo_helms-charts_router:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.31.0\", \"versionEndIncluding\": \"1.32.0\", \"matchCriteriaId\": \"7E5629BA-4004-4210-B632-6E80CF4383D5\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.\"}, {\"lang\": \"es\", \"value\": \"Apollo Router es un router de gr\\u00e1ficos configurable y de alto rendimiento escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation. Las versiones afectadas est\\u00e1n sujetas a una vulnerabilidad de tipo Denegaci\\u00f3n de Servicio (DoS) que hace que el Router entre en p\\u00e1nico y finalice cuando se env\\u00eda una respuesta de varias partes. Cuando los usuarios env\\u00edan consultas al Router que utiliza `@defer` o Suscripciones, el Router entrar\\u00e1 en p\\u00e1nico. Para ser vulnerables, los usuarios de Router deben tener un coprocesador con `coprocessor.supergraph.response` configurado en su `router.yaml` y tambi\\u00e9n admitir `@defer` o Suscripciones. La versi\\u00f3n 1.33.0 de Apollo Router tiene una soluci\\u00f3n para esta vulnerabilidad que se introdujo en el PR #4014. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben evitar el uso de la respuesta supergraph del coprocesador o desactivar el soporte de aplazamiento y suscripciones y continuar usando la respuesta supergraph del coprocesador.\"}]",
      "id": "CVE-2023-45812",
      "lastModified": "2024-11-21T08:27:24.350",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2023-10-18T22:15:09.403",
      "references": "[{\"url\": \"https://github.com/apollographql/router/pull/4014\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/apollographql/router/pull/4014\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-754\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-754\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-45812\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-10-18T22:15:09.403\",\"lastModified\":\"2024-11-21T08:27:24.350\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.\"},{\"lang\":\"es\",\"value\":\"Apollo Router es un router de gr\u00e1ficos configurable y de alto rendimiento escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation. Las versiones afectadas est\u00e1n sujetas a una vulnerabilidad de tipo Denegaci\u00f3n de Servicio (DoS) que hace que el Router entre en p\u00e1nico y finalice cuando se env\u00eda una respuesta de varias partes. Cuando los usuarios env\u00edan consultas al Router que utiliza `@defer` o Suscripciones, el Router entrar\u00e1 en p\u00e1nico. Para ser vulnerables, los usuarios de Router deben tener un coprocesador con `coprocessor.supergraph.response` configurado en su `router.yaml` y tambi\u00e9n admitir `@defer` o Suscripciones. La versi\u00f3n 1.33.0 de Apollo Router tiene una soluci\u00f3n para esta vulnerabilidad que se introdujo en el PR #4014. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben evitar el uso de la respuesta supergraph del coprocesador o desactivar el soporte de aplazamiento y suscripciones y continuar usando la respuesta supergraph del coprocesador.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.31.0\",\"versionEndIncluding\":\"1.32.0\",\"matchCriteriaId\":\"E5CBFBBF-CA05-439F-B7D9-0F0160C90006\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apollographql:apollo_helms-charts_router:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.31.0\",\"versionEndIncluding\":\"1.32.0\",\"matchCriteriaId\":\"7E5629BA-4004-4210-B632-6E80CF4383D5\"}]}]}],\"references\":[{\"url\":\"https://github.com/apollographql/router/pull/4014\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/apollographql/router/pull/4014\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\", \"name\": \"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/apollographql/router/pull/4014\", \"name\": \"https://github.com/apollographql/router/pull/4014\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T20:29:32.278Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-45812\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-13T14:58:32.929626Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:apollographql:apollo_router:1.31.0:*:*:*:*:*:*:*\"], \"vendor\": \"apollographql\", \"product\": \"apollo_router\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.31.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.33.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-13T15:02:10.104Z\"}}], \"cna\": {\"title\": \"Improper Check or Handling of Exceptional Conditions in apollo-router\", \"source\": {\"advisory\": \"GHSA-r344-xw3p-2frj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"apollographql\", \"product\": \"router\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.31.0, \u003c 1.33.0\"}]}], \"references\": [{\"url\": \"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\", \"name\": \"https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/apollographql/router/pull/4014\", \"name\": \"https://github.com/apollographql/router/pull/4014\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-754\", \"description\": \"CWE-754: Improper Check for Unusual or Exceptional Conditions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-10-18T21:29:32.731Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-45812\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-13T15:02:17.414Z\", \"dateReserved\": \"2023-10-13T12:00:50.437Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-10-18T21:29:32.731Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-R344-XW3P-2FRJ

Vulnerability from github – Published: 2023-10-19 16:08 – Updated: 2023-10-19 16:08

Summary

Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions

Details

Impact

To be vulnerable, users of Router must have a coprocessor with coprocessor.supergraph.response configured in their router.yaml and also to support either @defer or Subscriptions.

Patches

Router version 1.33.0 has a fix for this vulnerability. https://github.com/apollographql/router/pull/4014 fixes the issue.

Workarounds

For affected versions, avoid using the coprocessor supergraph response:

# do not use this stage in your coprocessor configuration
coprocessor:
  supergraph:
    response:

Or you can disable defer and subscriptions support:

# disable defer and subscriptions:
supergraph:
  defer_support: false # enabled by default
subscription:
  enabled: false # disabled by default

and continue to use the coprocessor supergraph response.

References

https://github.com/apollographql/router/issues/4013

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "apollo-router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.31.0"
            },
            {
              "fixed": "1.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-45812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-703",
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-19T16:08:10Z",
    "nvd_published_at": "2023-10-18T22:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic.\n \nTo be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions.  \n\n### Patches\nRouter version 1.33.0 has a fix for this vulnerability. https://github.com/apollographql/router/pull/4014 fixes the issue.  \n\n### Workarounds\nFor affected versions, avoid using the coprocessor supergraph response:\n```yml\n# do not use this stage in your coprocessor configuration\ncoprocessor:\n  supergraph:\n    response:\n``` \n\nOr you can disable defer and subscriptions support:\n```yml\n# disable defer and subscriptions:\nsupergraph:\n  defer_support: false # enabled by default\nsubscription:\n  enabled: false # disabled by default\n```\nand continue to use the coprocessor supergraph response.\n### References\nhttps://github.com/apollographql/router/issues/4013\n",
  "id": "GHSA-r344-xw3p-2frj",
  "modified": "2023-10-19T16:08:10Z",
  "published": "2023-10-19T16:08:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45812"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apollographql/router/issues/4013"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apollographql/router/pull/4014"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apollographql/router/commit/b917b8c117b46a2d508428c0856f4927dfcfc341"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apollographql/router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions"
}

GSD-2023-45812

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-45812

Aliases

CVE-2023-45812

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-45812",
    "id": "GSD-2023-45812"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-45812"
      ],
      "details": "The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.",
      "id": "GSD-2023-45812",
      "modified": "2023-12-13T01:20:38.355521Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-45812",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "router",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.31.0, \u003c 1.33.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "apollographql"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-754",
                "lang": "eng",
                "value": "CWE-754: Improper Check for Unusual or Exceptional Conditions"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj",
            "refsource": "MISC",
            "url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
          },
          {
            "name": "https://github.com/apollographql/router/pull/4014",
            "refsource": "MISC",
            "url": "https://github.com/apollographql/router/pull/4014"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-r344-xw3p-2frj",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.32.0",
                "versionStartIncluding": "1.31.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apollographql:apollo_helms-charts_router:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.32.0",
                "versionStartIncluding": "1.31.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-45812"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-754"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Vendor Advisory"
              ],
              "url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
            },
            {
              "name": "https://github.com/apollographql/router/pull/4014",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/apollographql/router/pull/4014"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-10-30T14:55Z",
      "publishedDate": "2023-10-18T22:15Z"
    }
  }
}

FKIE_CVE-2023-45812

Vulnerability from fkie_nvd - Published: 2023-10-18 22:15 - Updated: 2024-11-21 08:27

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/apollographql/router/pull/4014	Patch
security-advisories@github.com	https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj	Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/apollographql/router/pull/4014	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	apollographql	apollo_router	*
	apollographql	apollo_helms-charts_router	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5CBFBBF-CA05-439F-B7D9-0F0160C90006",
              "versionEndIncluding": "1.32.0",
              "versionStartIncluding": "1.31.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apollographql:apollo_helms-charts_router:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E5629BA-4004-4210-B632-6E80CF4383D5",
              "versionEndIncluding": "1.32.0",
              "versionStartIncluding": "1.31.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response."
    },
    {
      "lang": "es",
      "value": "Apollo Router es un router de gr\u00e1ficos configurable y de alto rendimiento escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation. Las versiones afectadas est\u00e1n sujetas a una vulnerabilidad de tipo Denegaci\u00f3n de Servicio (DoS) que hace que el Router entre en p\u00e1nico y finalice cuando se env\u00eda una respuesta de varias partes. Cuando los usuarios env\u00edan consultas al Router que utiliza `@defer` o Suscripciones, el Router entrar\u00e1 en p\u00e1nico. Para ser vulnerables, los usuarios de Router deben tener un coprocesador con `coprocessor.supergraph.response` configurado en su `router.yaml` y tambi\u00e9n admitir `@defer` o Suscripciones. La versi\u00f3n 1.33.0 de Apollo Router tiene una soluci\u00f3n para esta vulnerabilidad que se introdujo en el PR #4014. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben evitar el uso de la respuesta supergraph del coprocesador o desactivar el soporte de aplazamiento y suscripciones y continuar usando la respuesta supergraph del coprocesador."
    }
  ],
  "id": "CVE-2023-45812",
  "lastModified": "2024-11-21T08:27:24.350",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-10-18T22:15:09.403",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/apollographql/router/pull/4014"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/apollographql/router/pull/4014"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-45812 (GCVE-0-2023-45812)

GHSA-R344-XW3P-2FRJ

Impact

Patches

Workarounds

References

GSD-2023-45812

FKIE_CVE-2023-45812

Tags

Sightings

Nomenclature