InQL Scanner - A Burp Extension For GraphQL Security Testing

A security testing tool to facilitate GraphQL technology security auditing efforts. InQL can be used as a stand-alone script, or as a Burp Suite extension. InQL Stand-Alone Running inql from Python will issue an Introspection query to the target GraphQL endpoint in order fetch metadata informatio...

HackerOne: program_analytics_benchmarks query shows information not visible in public

Summary: programanalyticsbenchmarks is displaying information i don't see yet in public profile of a program. Description: I tried querying programanalyticsbenchmarks for the program security and ██████ and it showing information i cannot find in public profile especially in ███████ Steps To...

HackerOne: Read-only team members can read all properties of webhooks

Description: A team member can view all properties of webhooks despite not needing them. Steps To Reproduce 1. Have an admin of a program setup webhooks 2. As a team member read-onlylog in 3. Run the following graphql query: query teamhandle: "security" name webhooks nodes id secret url 4. See th...

CVE-2019-13005

An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. It has Incorrect Access Control...

Authorization

An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. It has Incorrect Access Control...

CVE-2019-13005

Removed by vendor...

HackerOne: Changes to data in a CVE request after draft via GraphQL query

Summary: Our team has conducted a number of studies tests in the field of CVE Request. We found several statuses of such requests Awaiting Publication, Pending HackerOne approval, Cancelled . At the time of creating the request , we can change the data. However, we noticed that we can 't change...

HackerOne: Customer private program can disclose email any users through invited via username

Summary: Hey team,This bug could have been used by my calculations a long time ago Steps To Reproduce: 1Go to https://hackerone.com/hackeroneh1pbbp3/launch 2Take invite via username 3Input username , send invite 3.1When an invite is created, we get a token 4Now Go use GraphQL query...

HackerOne: GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend

HackerOne exposes a small number of ActiveResource objects through its GraphQL node interface. ActiveResource objects use HTTP as transport layer in order to fetch data. Four of these models, TaxForm, Payout, Payment, and PayoutPreference are fetched from an internal Payments backend system with ...

CVE-2019-12437

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,...

CVE-2019-12437

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,...

Cross site request forgery (csrf)

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,...

CVE-2019-12437

CVE-2019-12437 affects SilverStripe up to 4.3.3, where the prior fix for SS-2018-007 does not fully mitigate CSRF in GraphQL mutations. Connected sources (GHSA/OSV/Red Hat) indicate this CSRF protection was not complete and fixes exist in SilverStripe GraphQL at versions 2.0.5 and 3.1.2. Remediat...

CVE-2019-12437

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,...

HackerOne: Email address of any user can be queried on Report Invitation GraphQL type when username is known

Summary: Email id of all hackerone users disclosure Description: There is an flaw , with that i can get all hackerone users email id Steps To Reproduce 1. Invoke the below graphql call POST /graphql HTTP/1.1 "query":"mutation Revokecredentialmutation$input0:AddReportParticipantInput!...

FreeBSD : Gitlab -- Multiple Vulnerabilities (c5bd9068-440f-11ea-9cdb-001b217b3468)

Gitlab reports : Path Traversal to Arbitrary File Read User Permissions Not Validated in ProjectExportWorker XSS Vulnerability in File API Package and File Disclosure through GitLab Workhorse XSS Vulnerability in Create Groups Issue and Merge Request Activity Counts Exposed Email Confirmation...

New Relic: Account owner/admin can't actually delete personal users' API keys

Hey team, An account owner/admin should be able to remove API keys belonging to other users in a case of, for instance, they are compromised. This sentence is confirmed by your own docs: F695035 However, the account owner/admin can't actually do this so he can't protect the account data from bein...

HackerOne: Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects

The Checklist objects that can be queried through GraphQL are supposed to only be accessible by program members, the users who claimed or responded to a check belonging to a checklist, and HackerOne Pentesters. The Checklist object is also supposed to be in the running state e.g. when the platfor...

HackerOne: HackerOne Pentesters can access any structured scope object through GraphQL node interface

A missing authorization check in the StructuredScope protector class app/protectors/protectedstructuredscope.rb:42 enables any HackerOne Pentester to access structured scope objects of programs they aren't invited to or aren't running a penetration test through HackerOne. ruby class...

New Relic: Restricted user can update Apdex target for applications by leveraging the GraphQL mutation

Hey team, I've found that Restricted user can update Apdex target for applications by leveraging the GraphQL mutation which doesn't properly implement authorization. Steps to reproduce 1 Sign in NR with Restricted user 2 Navigate to https://api.newrelic.com/graphiql, intercept the request to...