graphql playground 在web页面生成时对输入的转义处理不恰当（跨站脚本）

CVE编号

CVE-2021-41249

利用情况

暂无

补丁情况

N/A

披露时间

2021-11-05

漏洞描述

GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/graphql/graphiql/security/advisories/GHSA-x4r7-m2q9-69c8
https://github.com/graphql/graphql-playground/commit/b8a956006835992f12c46b90...
https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	graphql	playground	*		Up to (excluding) 1.7.28

CVSS3评分 7.1

• 攻击路径 网络
• 攻击复杂度 高
• 权限要求 无
• 影响范围 未更改
• 用户交互 需要
• 可用性 低
• 保密性 高
• 完整性 高

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L CWE-ID 漏洞类型 CWE-79 在Web页面生成时对输入的转义处理不恰当（跨站脚本）