Top Security Risks in GraphQL

mood · Sep 21, 2019

Top Security Risks in GraphQL
September 20, 2019
https://www.fromdev.com/2019/09/top-security-risks-in-graphql.html

As Roy Derks said, “GraphQL will do to REST what JSON did to XML.” Numerically, Roy is correct. GraphQL is a query language was announced by FaceBook in late 2015 and has grown significantly in popularity.

The web is evolving and currently, it’s in a serverless/microservice fury. GraphQL is slowly consuming the API domain while front-end apps gain momentum. This is why it’s important to understand what GraphQL is, and why REST services are giving way. As new technologies emerge, they carry new risks.
It’s a single endpoint that returns flexible data structures. However, while enabling the requestor to grab the information they want is powerful, it’s also dangerous. [...]
Click to expand...

mood · Apr 7, 2020

InQL will help developers discover GraphQL vulnerabilities
April 7, 2020
https://portswigger.net/daily-swig/inql-will-help-developers-discover-graphql-vulnerabilities

InQL, a new open source tool released by Doyensec, aims to help speed up the process of finding security flaws in applications that use GraphQL.

“GraphQL addresses some of the traditional web vulnerabilities but it doesn’t protect by default against access control flaws, insecure direct object reference (IDOR) vulnerabilities and information leakage.”
Finding such bugs requires invoking all application queries and mutations, which is often difficult to achieve.
Time for introspection
Developed by Doyensec, InQL is available as a standalone application or an extension for Burp Suite

The tool’s ‘introspection’ feature allows applications to ask a GraphQL endpoint for the queries it supports. This makes it possible to extract all the available fields and ensure coverage during testing. (Incidentally, InQL gets its name from Introspection and GraphQL.)
He added: “On the other hand, we expect vulnerabilities and attacks against GraphQL to improve over time since this is a new field of research.”
Click to expand...

mood · Nov 12, 2021

Emerging Security Tools Tackle GraphQL Security
November 12, 2021
https://www.darkreading.com/dr-tech/emerging-security-tools-tackle-graphql-security

One good thing about GraphQL is that the query language makes it easy to interact with structured data and perform multiple actions with a single API call. However, that same flexibility makes APIs built using GraphQL more difficult to secure, potentially exposing more data than intended.

Salt Security recently updated its Salt Security API Protection Platform to offer more robust tooling for securing GraphQL APIs. The tools rely on artificial intelligence and machine learning to generate a baseline of normal API behavior and identifying malicious efforts when the actors are probing the APIs as part of their reconnaissance activities. The company’s goal is to proactively provide developers with tools for securing these APIs before the attacks become more commonplace.
Click to expand...

Malicious actors have already begun developing attack techniques targeting GraphQL capabilities such as nested queries and query batching — a form of brute-force attacks— to run denial-of-service attacks, Koren says. The attackers can launch a DoS by using nested queries that increase the load on the API.
Attackers have taken advantage of the complex access control structure in GraphQL to uncover and exploit critical vulnerabilities, Koren says

Underscoring the growing awareness that APIs need to be protected, Data Theorem recently launched its Active Protection suite, which protects the client layer (mobile and web), the network layer (REST and GraphQL APIs), and the underlying cloud infrastructure.
Click to expand...

A 2020 RapidAPI survey found that GraphQL is used by 22.5% of API developers. The number of developers using GraphQL doubled between 2019 and 2020, and the pace of adoption is expected to accelerate even more.
Click to expand...

Log in or Sign up

Top Security Risks in GraphQL

mood Updates Team

mood Updates Team

mood Updates Team