GHSA-cqmq-8755-7xvh: Input Validation
Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set.
Impact This affects any project relying on graphql.maxTake to bound the number of items returned per query.
Patches This issue has been patched in @keystone-6/core version 6.5.3.
If you cannot patch, you can workaround this by restricting take input values in your GraphQL queries to the bounded value, or by blocking negative values.
Credit This issue was found by Haxset's Security Scanner and validated by their team.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@keystone-6/coreto a version that resolves this vulnerability.Fixed in 6.5.3 - Upgrade
Upgrade
@keystone-6/coreto a version that resolves this vulnerability.Fixed in 6.5.3 - Compensating control
If you cannot patch, restrict `take` input values in your GraphQL queries to the bounded value or block negative values to prevent bypassing `graphql.maxTake` via negative input.
Event History
Frequently Asked Questions
Which deployments are affected?
Any project that relies on graphql.maxTake to limit the number of items returned by a GraphQL query is affected if it uses an unpatched version of @keystone-6/core. The issue is patched in version 6.5.3.
What does an attacker need to exploit this?
An attacker needs to submit a GraphQL query with a negative take input value. No authentication or user interaction is indicated by the provided severity vector.
What can be done if updating is not immediately possible?
Restrict take input values in GraphQL queries to the configured bounded value, or block negative take values. This prevents the maxTake limit from being bypassed.
How can we determine whether our application is exposed?
Review whether your application uses graphql.maxTake as a per-query result limit and whether GraphQL queries can supply take values. A negative take value returning more items than the configured limit indicates exposure.