Overview
About vulnerability
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking.
More precisely, an application is vulnerable when all the following are true:
- the application has enabled the GraphQL WebSocket transport
- the application relies on cookie-based session authentication
- the application does not have custom Spring Security WebSocket-level Origin enforcement configured
When all the conditions above are met, an attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim’s credentials.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Boot @ 2.7.18 (+1136 more)