CVE-2023-41317
📋 TL;DR
A Denial-of-Service vulnerability in Apollo Router versions 1.28.0-1.29.0 causes the router to crash and terminate when specific conditions are met with GraphQL subscriptions. This affects organizations running Apollo Router with subscriptions enabled and a supergraph schema containing subscription types. The vulnerability can be triggered by sending an anonymous subscription operation.
💻 Affected Systems
- Apollo Router
📦 What is this software?
Apollo Router by Apollographql
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage where Apollo Router crashes and stops processing all GraphQL operations, requiring manual restart of the service.
Likely Case
Intermittent service disruptions when anonymous subscription operations are sent to vulnerable configurations, causing router restarts.
If Mitigated
No impact if subscriptions are disabled or if running patched version 1.29.1+.
🎯 Exploit Status
Exploitation requires sending a specific GraphQL subscription operation but no authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.29.1
Vendor Advisory: https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx
Restart Required: Yes
Instructions:
1. Stop Apollo Router service. 2. Update to version 1.29.1 using your package manager or download from releases. 3. Restart Apollo Router service.
🔧 Temporary Workarounds
Disable GraphQL Subscriptions
allIf subscriptions are not required, disable them in the router configuration to prevent exploitation.
Edit router configuration YAML to ensure subscriptions are not enabled or set enabled: false
🧯 If You Can't Patch
- Disable GraphQL subscriptions in router configuration if not required
- Implement WAF rules to block anonymous subscription operations at network perimeter
🔍 How to Verify
Check if Vulnerable:
Check Apollo Router version and configuration: 1. Verify version is 1.28.0, 1.28.1, or 1.29.0. 2. Check if subscriptions are enabled in YAML config. 3. Verify supergraph schema contains subscription type.Check Version:
apollo-router --versionVerify Fix Applied:
Confirm Apollo Router version is 1.29.1 or later using version check command.📡 Detection & Monitoring
Log Indicators:
- Router panic messages in logs
- Process termination/crash logs
- Error messages related to subscription handling
Network Indicators:
- Anonymous GraphQL subscription operations
- Sudden service unavailability after subscription requests
SIEM Query:
source="apollo-router" AND (panic OR crash OR termination) AND subscription🔗 References
- https://github.com/apollographql/router/commit/b295c103dd86c57c848397d32e8094edfa8502aa
- https://github.com/apollographql/router/releases/tag/v1.29.1
- https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx
- https://github.com/apollographql/router/commit/b295c103dd86c57c848397d32e8094edfa8502aa
- https://github.com/apollographql/router/releases/tag/v1.29.1
- https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx
