Top Security Risks in GraphQL

mood · Sep 21, 2019

Top Security Risks in GraphQL
September 20, 2019
https://www.fromdev.com/2019/09/top-security-risks-in-graphql.html

As Roy Derks said, “GraphQL will do to REST what JSON did to XML.” Numerically, Roy is correct. GraphQL is a query language was announced by FaceBook in late 2015 and has grown significantly in popularity.

The web is evolving and currently, it’s in a serverless/microservice fury. GraphQL is slowly consuming the API domain while front-end apps gain momentum. This is why it’s important to understand what GraphQL is, and why REST services are giving way. As new technologies emerge, they carry new risks.
It’s a single endpoint that returns flexible data structures. However, while enabling the requestor to grab the information they want is powerful, it’s also dangerous. [...]
Click to expand...

mood · Apr 7, 2020

InQL will help developers discover GraphQL vulnerabilities
April 7, 2020
https://portswigger.net/daily-swig/inql-will-help-developers-discover-graphql-vulnerabilities

InQL, a new open source tool released by Doyensec, aims to help speed up the process of finding security flaws in applications that use GraphQL.

“GraphQL addresses some of the traditional web vulnerabilities but it doesn’t protect by default against access control flaws, insecure direct object reference (IDOR) vulnerabilities and information leakage.”
Finding such bugs requires invoking all application queries and mutations, which is often difficult to achieve.
Time for introspection
Developed by Doyensec, InQL is available as a standalone application or an extension for Burp Suite

The tool’s ‘introspection’ feature allows applications to ask a GraphQL endpoint for the queries it supports. This makes it possible to extract all the available fields and ensure coverage during testing. (Incidentally, InQL gets its name from Introspection and GraphQL.)
He added: “On the other hand, we expect vulnerabilities and attacks against GraphQL to improve over time since this is a new field of research.”
Click to expand...

Log in or Sign up

Top Security Risks in GraphQL

mood Updates Team

mood Updates Team

Log in or Sign up

Top Security Risks in GraphQL

mood Updates Team

mood Updates Team

Useful Searches