CVE-2021-47715
📋 TL;DR
CVE-2021-47715 is a server-side request forgery vulnerability in Hasura GraphQL Engine that allows attackers to inject malicious remote schema URLs through the add_remote_schema endpoint. This enables attackers to potentially access internal network resources by sending crafted POST requests to the /v1/query endpoint. Organizations running Hasura GraphQL Engine 1.3.3 are affected.
💻 Affected Systems
- Hasura GraphQL Engine
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal services, exfiltrate data from internal networks, or pivot to other systems within the environment.
Likely Case
Unauthorized access to internal HTTP services, potential data leakage from internal APIs, and reconnaissance of internal network resources.
If Mitigated
Limited impact with proper network segmentation and access controls preventing internal resource access.
🎯 Exploit Status
Exploitation requires authentication to Hasura but is straightforward with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.4 and later
Vendor Advisory: https://github.com/hasura/graphql-engine/security/advisories/GHSA-4w8f-hjmf-9fxc
Restart Required: Yes
Instructions:
1. Update Hasura GraphQL Engine to version 1.3.4 or later. 2. Restart the Hasura service. 3. Verify the update by checking the version endpoint.
🔧 Temporary Workarounds
Disable Remote Schema Endpoint
allTemporarily disable the add_remote_schema endpoint if not required
Configure Hasura to disable remote schema functionality via environment variable: HASURA_GRAPHQL_ENABLE_REMOTE_SCHEMA_PERMISSIONS=false
Network Segmentation
allRestrict Hasura's outbound network access to prevent SSRF exploitation
Configure firewall rules to block Hasura container/instance from accessing internal network resources
🧯 If You Can't Patch
- Implement strict authentication and authorization controls to limit who can access the /v1/query endpoint
- Deploy network segmentation to isolate Hasura from sensitive internal resources
🔍 How to Verify
Check if Vulnerable:
Check Hasura version via HTTP request to /v1/version endpoint or docker inspect for version 1.3.3Check Version:
curl -X POST http://hasura-host:8080/v1/versionVerify Fix Applied:
Verify version is 1.3.4 or later via /v1/version endpoint and test SSRF attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /v1/query with remote schema URLs
- Multiple failed remote schema connection attempts
- Requests to internal IP addresses from Hasura
Network Indicators:
- Hasura making outbound HTTP requests to internal IP ranges
- Unusual traffic patterns from Hasura to non-standard ports
SIEM Query:
source="hasura" AND (url="/v1/query" AND payload CONTAINS "add_remote_schema")