CVE-2024-23841
📋 TL;DR
CVE-2024-23841 is a cross-site scripting vulnerability in the @apollo/experimental-apollo-client-nextjs NPM package that allows attackers to execute arbitrary JavaScript in users' browsers. This affects applications using Apollo Client with Next.js App Router that handle untrusted GraphQL data or user inputs. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- @apollo/experimental-apollo-client-nextjs
📦 What is this software?
Apollo Client by Apollographql
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, data theft, and malicious actions performed on behalf of authenticated users through persistent XSS attacks.
Likely Case
Session hijacking, credential theft, and unauthorized actions within the affected application.
If Mitigated
Limited impact with proper content security policies and input validation, though still potentially dangerous.
🎯 Exploit Status
Exploitation requires either malicious user input injection or compromised GraphQL server responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7.0 or later
Vendor Advisory: https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg
Restart Required: Yes
Instructions:
1. Update package.json to use @apollo/experimental-apollo-client-nextjs version 0.7.0 or higher. 2. Run npm update or yarn upgrade. 3. Restart your Next.js application server.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd strict CSP headers to prevent script execution from untrusted sources
Input Validation and Sanitization
allImplement server-side validation and sanitization of all GraphQL responses and user inputs
🧯 If You Can't Patch
- Implement strict Content Security Policy with script-src directives
- Add input validation and output encoding for all user-controlled data
🔍 How to Verify
Check if Vulnerable:
Check package.json for @apollo/experimental-apollo-client-nextjs version below 0.7.0Check Version:
npm list @apollo/experimental-apollo-client-nextjsVerify Fix Applied:
Verify package.json shows version 0.7.0 or higher and test application functionality📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL query patterns
- JavaScript execution errors in browser logs
- Unexpected redirects or cookie access
Network Indicators:
- Suspicious script tags in HTTP responses
- Unusual outbound connections from client browsers
SIEM Query:
source="web_server" AND ("script" OR "javascript") AND status=200 AND uri="*graphql*"🔗 References
- https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b
- https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg
- https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b
- https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg
