CVE-2024-40094

CVE-2024-40094 ENF（可执行规范化字段）拒绝服务漏洞利用 此脚本利用 graphql-java 中的 CVE-2024-40094 漏洞，通过触发 可执行规范化字段（ExecutableNormalizedFields, ENF） 实现拒绝服务攻击。它构建了一个带有深度嵌套别名的精心构造的 GraphQL 内省查询，旨在压垮脆弱的服务器。 概述 该脚本使用异步请求向目标 GraphQL 服务器发送一系列结构庞大的内省查询。查询以 JSON 格式发送，其结构专门用于利用 GraphQL...

Security Bulletin: IBM PowerVM Novalink is vulnerable because GraphQL Java (aka graphql-java) is vulnerable to a denial of service, caused by the failure to properly consider ExecutableNormalizedFields. (CVE-2024-40094)

Summary IBM PowerVM Novalink is vulnerable because GraphQL Java aka graphql-java is vulnerable to a denial of service, caused by the failure to properly consider ExecutableNormalizedFields ENFs as part of preventing denial of service. By using introspection queries, a remote attacker could exploi...

Exploit for CVE-2024-40094

CVE-2024-40094 ENF ExecutableNormalizedFields Denial of Serv...

CVE-2024-40094

A vulnerability was found in GraphQL Java, affecting versions prior to 21.5. This flaw allows an attacker to perform a denial of service DoS attack via introspection queries. The issue arises due to the improper handling of ExecutableNormalizedFields ENFs, which are not adequately considered duri...

GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENFs as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions...

CVE-2024-40094

GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENFs as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions...

CVE-2024-40094: Undefined Security Weakness

GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENFs as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions...