GHSA-cgqf-3cq5-wvcj CVE-2024-28101
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.77%
- Chance of exploitation in the next 30 days. Higher than 55.63% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
- Fix
1.40.2- Upgrade apollo-router to this version or later
Description
Impact
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the limits.http_max_request_bytes configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded.
Patches
Router version 1.40.2 has a fix for the vulnerability.
Workarounds
If you are unable to upgrade, you may be able to implement mitigations at proxies or load balancers positioned in front of your Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| apollo-router | >= 0.9.5, < 1.40.2 |
1.40.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
apollo-router crates.io → 1.40.2
- cargo
cargo update -p apollo-router --precise 1.40.2
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hff2-gcpx-8f4p Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery | Medium | Also affects apollo-router |
| GHSA-x33c-7c2v-mrj9 Apollo Router Affected by an Access Control Bypass on Polymorphic Types | High | Also affects apollo-router |
| GHSA-g8jh-vg5j-4h3f Apollo Router Improperly Enforces Renamed Access Control Directives | High | Also affects apollo-router |
| GHSA-3j43-9v8v-cp3f Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing | High | Also affects apollo-router |
| GHSA-84m6-5m72-45fp Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow | High | Also affects apollo-router |
| GHSA-75m2-jhh5-j5g2 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion | High | Also affects apollo-router |
| GHSA-94hh-jmq8-2fgp Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass | High | Also affects apollo-router |
| GHSA-x6xq-whh3-gg32 Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies | High | Also affects apollo-router |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor