Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router

Summary

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when all of the following conditions are met: 1. Running Apollo Router v1.28.0, v1.28.1 or v1.29.0 ("impacted versions"); and 2. The Supergraph schema provided to the Router (either via Apollo Uplink or explicitly via other configuration) has a `subscription` type with root-fields defined; and 3. The YAML configuration provided to the Router has subscriptions enabled (they are disabled by default), either by setting `enabled: true` or by setting a valid `mode` within the `subscriptions` object (as seen in subscriptions' documentation); and 4. An anonymous (i.e., un-named) `subscription` operation (e.g., `subscription { ... }`) is received by the Router If all four of these criteria are met, the impacted versions will panic and terminate. There is no data-privacy risk or sensitive-information exposure aspect to this vulnerability. This is fixed in Apollo Router v1.29.1. Users are advised to upgrade. Updating to v1.29.1 should be a clear and simple upgrade path for those running impacted versions. However, if Subscriptions are not necessary for your Graph – but are enabled via configuration — then disabling subscriptions is another option to mitigate the risk.

Timeline

1. Sep 5, 2023, 6:31 PM UTCCVE published
2. Sep 30, 2024, 7:17 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Sep 30, 2024, 7:17 PM UTCRecord last updated

Affected versions

• apollographql router

  From 1.28.0 · fixed in 1.29.1

• apollo-routercrates.io

  From 1.28.0 · fixed in 1.29.1

References 3