CVE-2023-28867
📋 TL;DR
CVE-2023-28867 is a denial-of-service vulnerability in GraphQL Java (graphql-java) where an attacker can send a specially crafted GraphQL query that causes excessive stack consumption, potentially crashing the application. This affects all applications using vulnerable versions of graphql-java. The vulnerability allows unauthenticated attackers to disrupt service availability.
💻 Affected Systems
- GraphQL Java (graphql-java)
📦 What is this software?
Graphql Java by Graphql Java
Graphql Java by Graphql Java
Graphql Java by Graphql Java
Graphql Java by Graphql Java
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage through application crash, requiring manual restart and potentially causing data loss or service disruption.
Likely Case
Temporary denial of service affecting application availability until the process is restarted or the malicious query stops.
If Mitigated
Minimal impact with proper query depth limiting, rate limiting, and input validation in place.
🎯 Exploit Status
Exploitation requires sending a malicious GraphQL query, which is straightforward for attackers familiar with GraphQL. No authentication is required if GraphQL endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.1, 19.4, 18.4, 17.5, or 0.0.0-2023-03-20T01-49-44-80e3135
Vendor Advisory: https://github.com/graphql-java/graphql-java/releases
Restart Required: Yes
Instructions:
1. Identify graphql-java version in your project. 2. Update dependency to patched version (20.1, 19.4, 18.4, or 17.5 depending on your compatibility). 3. Rebuild and redeploy application. 4. Restart application services.
🔧 Temporary Workarounds
Implement Query Depth Limiting
allConfigure GraphQL server to limit maximum query depth to prevent deep nesting attacks
// Example for graphql-java: Use MaxQueryDepthInstrumentation or similar depth limiting
Implement Query Complexity Analysis
allAdd complexity analysis to reject queries that exceed configured complexity thresholds
// Use MaxQueryComplexityInstrumentation or custom complexity analysis
🧯 If You Can't Patch
- Implement WAF rules to block suspicious GraphQL queries with excessive nesting
- Deploy rate limiting on GraphQL endpoints to limit impact of DoS attempts
🔍 How to Verify
Check if Vulnerable:
Check your project's dependency file (pom.xml, build.gradle, etc.) for graphql-java version. If version is below 20.1, 19.4, 18.4, or 17.5, you are vulnerable.Check Version:
For Maven: mvn dependency:tree | grep graphql-java; For Gradle: gradle dependencies | grep graphql-javaVerify Fix Applied:
After updating, verify the graphql-java version in your dependency file matches one of the patched versions and test that deep nested queries are properly rejected.📡 Detection & Monitoring
Log Indicators:
- Stack overflow errors in application logs
- Abnormally large GraphQL query payloads
- Sudden application crashes with stack-related errors
Network Indicators:
- Large GraphQL queries with deep nesting patterns
- Repeated GraphQL queries from single source
SIEM Query:
source="application.logs" AND ("StackOverflowError" OR "java.lang.StackOverflowError") AND "graphql"🔗 References
- https://github.com/graphql-java/graphql-java/pull/3112
- https://github.com/graphql-java/graphql-java/releases/tag/v17.5
- https://github.com/graphql-java/graphql-java/releases/tag/v18.4
- https://github.com/graphql-java/graphql-java/releases/tag/v19.4
- https://github.com/graphql-java/graphql-java/releases/tag/v20.1
- https://github.com/graphql-java/graphql-java/pull/3112
- https://github.com/graphql-java/graphql-java/releases/tag/v17.5
- https://github.com/graphql-java/graphql-java/releases/tag/v18.4
- https://github.com/graphql-java/graphql-java/releases/tag/v19.4
- https://github.com/graphql-java/graphql-java/releases/tag/v20.1
