Authorization Bypass in graphql-shield
Low severity
GitHub Reviewed
Published
Sep 3, 2020
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Description
Reviewed
Aug 31, 2020
Published to the GitHub Advisory Database
Sep 3, 2020
Last updated
Jan 9, 2023
Versions of
graphql-shield
prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching optionno_cache
relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.Recommendation
Upgrade to version 6.0.6 or later.
References