Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency apollo-server-express to v2 [SECURITY] #635

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented May 28, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
apollo-server-express (source) 1.3.6 -> 2.14.2 age adoption passing confidence

GitHub Vulnerability Alerts

GHSA-w42g-7vfc-xf37

We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched versions.

Impact

If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport and are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If introspection: true is passed to the ApolloServer constructor options, the impact is limited to user-provided validation rules (i.e., using validationRules) since there would be no expectation that introspection was disabled.

The enforcement of user-provided validation rules on the HTTP transport is working as intended and is unaffected by this advisory. Similarly, disabling introspection on the HTTP transport is working as intended and is unaffected by this advisory.

Note: Unless subscriptions: false is explicitly passed to the constructor parameters of new ApolloServer({ ... }), subscriptions are enabled by default, whether or not there is a Subscription type present in the schema. As an alternative to upgrading to a patched version, see the Workarounds section below to disable subscriptions if it is not necessary.

In cases where subscriptions: false is not explicitly set, the subscription server is impacted since validation rules which are enforced on the main request pipeline within Apollo Server were not being passed to the SubscriptionServer.create invocation (seen here, prior to the patch).

The omitted validation rules for the subscription server include any validationRules passed by implementors to the ApolloServer constructor which were expected to be enforced on the subscriptions WebSocket endpoint. Additionally, because an internal NoIntrospection validation rule is used to disable introspection, it would have been possible to introspect a server on the WebSocket endpoint that the SubscriptionServer creates even though it was not possible on other transports (e.g. HTTP).

The severity of risk depends on whether sensitive information is being stored in the schema itself. The contents of schema descriptions, or secrets which might be revealed by the names of types or field names within those types, will determine the risk to individual implementors.

Affected packages

The bug existed in apollo-server-core versions prior to version 2.14.2, however, this means all integration packages (e.g., apollo-server-express, etc.) prior to version 2.14.2 which depend on apollo-server-core for their subscriptions support are affected. This includes the apollo-server package that automatically provides an Express server.

Therefore, for officially published Apollo Server packages, the full list of affected packages includes: apollo-server, apollo-server-azure-functions, apollo-server-cache-memcached, apollo-server-core, apollo-server-cloud-functions, apollo-server-cloudflare, apollo-server-express, apollo-server-fastify, apollo-server-hapi, apollo-server-koa, apollo-server-lambda, and apollo-server-micro.

Note: The full list included here doesn't fit into the box provided by the GitHub Security Advisories form.

Resolution

The problem is resolved in Apollo Server versions 2.14.2 or higher. If upgrading is not an option, see Workarounds below. When upgrading, ensure that the affected integration package (e.g., apollo-server-express) and the apollo-server-core package are both updated to the patched versions. (The version numbers should both be 2.14.2.)

Workarounds

Upgrading to a patched version is the recommended solution. If upgrading is not an option, subscriptions can be disabled with subscriptions: false to resolve the impact. Disabling subscriptions in this way will disable all subscriptions support and the WebSocket transport:

const server = new ApolloServer({
  subscriptions: false,
  /* Other options, such as typeDefs, resolvers, schema, etc. */
});

For more information

If you have any questions or comments about this advisory, please open an issue and the maintainers will try to assist.

Credit and appreciation

Apollo fully believes in ethical disclosure of vulnerabilities by security researchers who notify us with details and provide us time to address and fix the issues before publicly disclosing.

Credit for this discovery goes to the team at Bitwala, who reported the concern to us responsibly after discovering it during their own auditing.


Release Notes

apollographql/apollo-server (apollo-server-express)

v2.14.2

Compare Source

v2.14.1

Compare Source

v2.14.0

Compare Source

v2.13.1

Compare Source

v2.13.0

Compare Source

v2.12.0

Compare Source

v2.11.0

Compare Source

v2.10.1

Compare Source

v2.10.0

Compare Source

v2.9.16

Compare Source

v2.9.15

Compare Source

v2.9.14

Compare Source

v2.9.13

Compare Source

v2.9.12

Compare Source

v2.9.11

Compare Source

v2.9.10

Compare Source

v2.9.9

Compare Source

v2.9.8

Compare Source

v2.9.7

Compare Source

v2.9.6

Compare Source

v2.9.5

Compare Source

v2.9.4

Compare Source

v2.9.3

Compare Source

v2.9.2

Compare Source

v2.9.1

Compare Source

v2.9.0

Compare Source

v2.8.2

Compare Source

v2.8.1

Compare Source

v2.8.0

Compare Source

v2.7.2

Compare Source

v2.7.1

Compare Source

v2.7.0

Compare Source

v2.6.9

Compare Source

v2.6.8

Compare Source

v2.6.7

Compare Source

v2.6.6

Compare Source

v2.6.5

Compare Source

v2.6.4

Compare Source

v2.6.3

Compare Source

v2.6.2

Compare Source

v2.6.1

Compare Source

v2.6.0

Compare Source

v2.5.1

Compare Source

v2.5.0

Compare Source

v2.4.8

Compare Source

v2.4.7

Compare Source

v2.4.6

Compare Source

v2.4.5

Compare Source

v2.4.4

Compare Source

v2.4.3

Compare Source

v2.4.2

Compare Source

v2.4.1

Compare Source

v2.4.0

Compare Source

v2.3.3

Compare Source

v2.3.2

Compare Source

v2.3.1

Compare Source

v2.3.0

Compare Source

v2.2.7

Compare Source

v2.2.6

Compare Source

v2.2.5

Compare Source

v2.2.4

Compare Source

v2.2.3

Compare Source

v2.2.2

Compare Source

v2.2.1

Compare Source

v2.2.0

Compare Source

v2.1.0

Compare Source

v2.0.7

Compare Source

v2.0.6

Compare Source

v2.0.5

Compare Source

v2.0.4

Compare Source

v2.0.3

Compare Source

v2.0.2

Compare Source

v2.0.1

Compare Source

v2.0.0

Compare Source

v1.4.0

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot changed the title Update dependency apollo-server-express to v2 [SECURITY] Update dependency apollo-server-express to v2 [SECURITY] - autoclosed Apr 3, 2024
@renovate renovate bot closed this Apr 3, 2024
@renovate renovate bot deleted the renovate/npm-apollo-server-express-vulnerability branch April 3, 2024 13:26
@renovate renovate bot changed the title Update dependency apollo-server-express to v2 [SECURITY] - autoclosed Update dependency apollo-server-express to v2 [SECURITY] Apr 3, 2024
@renovate renovate bot reopened this Apr 3, 2024
@renovate renovate bot restored the renovate/npm-apollo-server-express-vulnerability branch April 3, 2024 17:15
@renovate renovate bot force-pushed the renovate/npm-apollo-server-express-vulnerability branch from 3b7472f to 0973614 Compare April 3, 2024 17:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants