Listen to this Post
This vulnerability is a context leakage/race condition in GraphQL servers using the `@envelop/graphql-modules` plugin with graphql-yoga. When `useGraphQLModules(application)` is used, it bypasses the async_hooks-based context isolation fix implemented in `graphql-modules` versions 2.4.1 and 3.1.1. The core issue occurs within GraphQL resolvers for a singleton service that injects context via the `@ExecutionContext()` decorator. When two or more parallel HTTP requests trigger the same service, the internally stored execution context in the singleton provider becomes corrupted. The `useGraphQLModules` plugin fails to properly scope the context per-request, leading to a race condition where one request’s context is replaced by another’s during asynchronous operations (e.g., a setTimeout). This causes the service’s `get()` method to return mismatched context IDs (id1 and id2) for the same GraphQL request, demonstrating definitive context bleeding between independent user sessions.
Platform: GraphQL Yoga
Version: ^5.0.0
Vulnerability : Context Race Condition
Severity: Critical
date: Unknown
Prediction: Patch TBD
What Undercode Say:
npm init -y npm i @envelop/graphql-modules@^9.0.0 graphql-yoga@^5.0.0 [email protected]
// src/service.ts
import { ExecutionContext, Injectable } from 'graphql-modules';
@Injectable()
export default class Service {
@ExecutionContext()
private context: ExecutionContext;
get() { return this.context.requestId; }
}
npm run compile && node dist/src/index.js npm run test
How Exploit:
Send parallel HTTP POST requests to the `/graphql` endpoint with queries triggering the vulnerable singleton service. Exploit requires no authentication, relying on natural server concurrency. Attacker can intercept or manipulate another user’s request context, potentially leading to data leakage or privilege escalation.
Protection from this CVE
Avoid `useGraphQLModules` plugin. Use GraphQL Modules’ native `createApplication` for context isolation. Upgrade `@envelop/graphql-modules` if patched. Implement custom context middleware. Use request-scoped providers.
Impact:
Data leakage between users. Broken authentication/authorization. Potential privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
