CVE-2023-41317

Date: September 5, 2023

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when all of the following conditions are met: 1. Running Apollo Router v1.28.0, v1.28.1 or v1.29.0 ("impacted versions"); and 2. The Supergraph schema provided to the Router (either via Apollo Uplink or explicitly via other configuration) has a "subscription" type with root-fields defined; and 3. The YAML configuration provided to the Router has subscriptions enabled (they are disabled by default), either by setting "enabled: true" or by setting a valid "mode" within the "subscriptions" object (as seen in "subscriptions' documentation" (https://www.apollographql.com/docs/router/executing-operations/subscription-support/#router-setup)); and 4. An "anonymous" (https://spec.graphql.org/draft/#sec-Anonymous-Operation-Definitions) (i.e., un-named) "subscription" operation (e.g., "subscription { ... }") is received by the Router If all four of these criteria are met, the impacted versions will panic and terminate. There is no data-privacy risk or sensitive-information exposure aspect to this vulnerability. This is fixed in Apollo Router v1.29.1. Users are advised to upgrade. Updating to v1.29.1 should be a clear and simple upgrade path for those running impacted versions. However, if Subscriptions are not necessary for your Graph – but are enabled via configuration — then disabling subscriptions is another option to mitigate the risk.

Language: RUST