Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
References
| Link | Resource |
|---|---|
| https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md | Third Party Advisory |
| https://github.com/ohler55/agoo/issues/109 | Exploit Issue Tracking Third Party Advisory |
| https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles | Third Party Advisory |
| https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md | Third Party Advisory |
| https://github.com/ohler55/agoo/issues/109 | Exploit Issue Tracking Third Party Advisory |
| https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles | Third Party Advisory |
Configurations
History
21 Nov 2024, 07:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md - Third Party Advisory | |
| References | () https://github.com/ohler55/agoo/issues/109 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles - Third Party Advisory |
07 Nov 2023, 03:47
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors. |
Information
Published : 2022-05-04 23:15
Updated : 2024-11-21 07:02
NVD link : CVE-2022-30288
Mitre link : CVE-2022-30288
CVE.ORG link : CVE-2022-30288
JSON object : View
Products Affected
ohler
- agoo
CWE