Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
概要
Parse Server: GraphQL __type introspection bypass via inline fragments when public introspection is disabled
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1 to before version 9.5.0, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory github.com
- web nvd.nist.gov