CVE-2023-50730
📋 TL;DR
Grackle GraphQL server versions before 0.18.0 contain two stack overflow vulnerabilities. Attackers can craft malicious GraphQL queries with cyclic fragments or deep nesting to cause denial of service via JVM StackOverflowError. All applications using vulnerable Grackle versions with untrusted user input are affected.
💻 Affected Systems
- Grackle GraphQL server
📦 What is this software?
Grackle by Typelevel
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to JVM crashes from stack overflow errors, requiring application restart.
Likely Case
Denial of service through resource exhaustion, causing service degradation or temporary unavailability.
If Mitigated
No impact if patched or proper input validation/sanitization is implemented.
🎯 Exploit Status
Exploitation requires minimal GraphQL knowledge. No authentication needed for parsing vulnerability; cyclic fragments require some schema knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.18.0
Vendor Advisory: https://github.com/typelevel/grackle/security/advisories/GHSA-g56x-7j6w-g8r8
Restart Required: Yes
Instructions:
1. Update Grackle dependency to version 0.18.0 or later. 2. Rebuild and redeploy application. 3. Restart service.
🔧 Temporary Workarounds
Input sanitization layer
allImplement query validation/sanitization before passing to Grackle parser
🧯 If You Can't Patch
- Implement WAF rules to block queries with excessive nesting depth
- Rate limit GraphQL endpoints and implement query complexity analysis
🔍 How to Verify
Check if Vulnerable:
Check Grackle version in build configuration (build.sbt, pom.xml, etc.) for versions <0.18.0Check Version:
Check build configuration files or run application with dependency listingVerify Fix Applied:
Confirm Grackle version 0.18.0+ in dependencies and test with known malicious queries📡 Detection & Monitoring
Log Indicators:
- StackOverflowError in JVM logs
- GraphQL parsing failures
- Unusual query patterns with deep nesting
Network Indicators:
- Large GraphQL queries with repetitive patterns
- Rapid query attempts to same endpoint
SIEM Query:
source="application.logs" AND ("StackOverflowError" OR "GraphQL parsing error")🔗 References
- https://github.com/typelevel/grackle/commit/56e244b91659cf385df590fc6c46695b6f36cbfd
- https://github.com/typelevel/grackle/releases/tag/v0.18.0
- https://github.com/typelevel/grackle/security/advisories/GHSA-g56x-7j6w-g8r8
- https://github.com/typelevel/grackle/commit/56e244b91659cf385df590fc6c46695b6f36cbfd
- https://github.com/typelevel/grackle/releases/tag/v0.18.0
- https://github.com/typelevel/grackle/security/advisories/GHSA-g56x-7j6w-g8r8
