Listen to this Post
During a recent bug bounty investigation, security researchers Juan Carlos Rodríguez and Antonio Rivera Poblete discovered a publicly exposed GraphQL endpoint belonging to a well-known organization. This endpoint leaked sensitive internal data without requiring authentication, including:
- Internal job titles (e.g., “Administration Officer”)
- Detailed salary ranges (minimum, maximum, and median)
- Geographic locations tied to salary data
- Internal URLs related to job searches
- Internal schemas accessible via introspection
The lack of API key or authentication violated the principle of least privilege, opening risks such as privilege escalation and business logic reverse engineering.
You Should Know:
1. Testing for Exposed GraphQL Endpoints
Common GraphQL endpoints to check:
– `/graphql`
– `/graphql/v1`
– `/api/graphql`
– `/query`
Use curl to test introspection:
curl -X POST -H "Content-Type: application/json" --data '{"query":"{__schema{types{name}}}"}' http://example.com/graphql
2. Exploiting Introspection Queries
If introspection is enabled, extract schema details:
query IntrospectionQuery {
__schema {
types {
name
fields {
name
type {
name
}
}
}
}
}
3. Preventing GraphQL Data Leaks
- Disable introspection in production:
const server = new ApolloServer({ introspection: false, playground: false, }); - Implement rate limiting (e.g., using
express-rate-limit). - Enforce authentication for all queries.
4. Detecting Misconfigurations with Tools
- GraphQLmap (Python-based exploitation tool):
git clone https://github.com/swisskyrepo/GraphQLmap python3 GraphQLmap.py -u http://example.com/graphql
- InQL (Burp Suite extension for GraphQL testing).
5. Securing GraphQL APIs
- Use persisted queries to restrict allowed operations.
- Apply query whitelisting.
- Log and monitor suspicious queries.
What Undercode Say
Exposed GraphQL endpoints are a goldmine for attackers. Always:
– Disable introspection in live environments.
– Require authentication for all sensitive queries.
– Monitor API traffic for abnormal patterns.
– Use query depth limiting to prevent DoS attacks.
For defenders:
Check for open GraphQL endpoints with Nmap nmap -p 80,443 --script http-graphql-info <target>
For attackers (ethical hacking):
Dump schema with CLI gql-cli http://example.com/graphql --introspect > schema.graphql
Expected Output:
A secured GraphQL API with:
- Introspection disabled
- Authentication enforced
- Query logging enabled
- Rate limiting implemented
Relevant URLs:
References:
Reported By: Juancarlos Rr – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
