CVE-2024-28101 (GCVE-0-2024-28101)
Vulnerability from cvelistv5
Published
2024-03-06 21:07
Modified
2024-08-05 16:57
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Summary
The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.
References
Impacted products
Vendor Product Version
apollographql router Version: >= 0.9.5, < 1.40.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:48:48.997Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj"
          },
          {
            "name": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "apollo_router",
            "vendor": "apollographql",
            "versions": [
              {
                "lessThan": "1.40.2",
                "status": "affected",
                "version": "0.9.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28101",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T16:54:18.252100Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:57:05.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "router",
          "vendor": "apollographql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.9.5, \u003c 1.40.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size. \n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-06T21:07:36.476Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj"
        },
        {
          "name": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413"
        }
      ],
      "source": {
        "advisory": "GHSA-cgqf-3cq5-wvcj",
        "discovery": "UNKNOWN"
      },
      "title": "Apollo Router\u0027s Compressed Payloads do not respect HTTP Payload Limits"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-28101",
    "datePublished": "2024-03-06T21:07:36.476Z",
    "dateReserved": "2024-03-04T14:19:14.058Z",
    "dateUpdated": "2024-08-05T16:57:05.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-28101\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-03-21T02:52:23.290\",\"lastModified\":\"2024-11-21T09:05:49.057\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size. \\n\"},{\"lang\":\"es\",\"value\":\"Apollo Router es un router de gr\u00e1ficos escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation. Las versiones 0.9.5 hasta 1.40.2 est\u00e1n sujetas a una vulnerabilidad de tipo Denegaci\u00f3n de servicio (DoS). Al recibir payloads HTTP comprimidos, las versiones afectadas del router eval\u00faan la opci\u00f3n de configuraci\u00f3n `limits.http_max_request_bytes` despu\u00e9s de descomprimir el payload comprimido en su totalidad. Si las versiones afectadas del router reciben payloads altamente comprimidos, esto podr\u00eda resultar en un consumo significativo de memoria mientras se expande el payload comprimido. La versi\u00f3n 1.40.2 del router tiene una soluci\u00f3n para la vulnerabilidad. Aquellos que no puedan actualizar pueden implementar mitigaciones en servidores proxy o balanceadores de carga ubicados frente a su flota de router (por ejemplo, Nginx, HAProxy o servicios WAF nativos de la nube) creando l\u00edmites en el tama\u00f1o de carga del cuerpo HTTP.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-409\"}]}],\"references\":[{\"url\":\"https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj\", \"name\": \"https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413\", \"name\": \"https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:48:48.997Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-28101\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-05T16:54:18.252100Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*\"], \"vendor\": \"apollographql\", \"product\": \"apollo_router\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.9.5\", \"lessThan\": \"1.40.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-05T16:56:54.988Z\"}}], \"cna\": {\"title\": \"Apollo Router\u0027s Compressed Payloads do not respect HTTP Payload Limits\", \"source\": {\"advisory\": \"GHSA-cgqf-3cq5-wvcj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"apollographql\", \"product\": \"router\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.9.5, \u003c 1.40.2\"}]}], \"references\": [{\"url\": \"https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj\", \"name\": \"https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413\", \"name\": \"https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size. \\n\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-409\", \"description\": \"CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-03-06T21:07:36.476Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-28101\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-05T16:57:05.215Z\", \"dateReserved\": \"2024-03-04T14:19:14.058Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-03-06T21:07:36.476Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.