Overview
About vulnerability
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
More precisely, an application is vulnerable when all the following are true:
- the application is using Spring GraphQL
- the application is using Jackson 2.x for JSON deserialization
- the application exposes a paginated (Connection) field
- the application’s classpath contains specific classes that can be leveraged to execute unintended logic during instantiation or deserialization
When all the conditions above are met, an attacker can craft a malicious GraphQL request that can lead to Remote Code Execution.