Executive Summary

CVE-2021-47713 is a denial of service (DoS) vulnerability in Hasura GraphQL version 1.3.3. It allows attackers to overwhelm the Hasura GraphQL service by crafting malicious GraphQL queries with excessively nested fields and extremely long query strings. Attackers can send repeated requests using multiple threads, which consumes server resources and can cause the GraphQL endpoint to crash. [2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial of service on your Hasura GraphQL endpoint. Attackers exploiting this flaw can consume excessive server resources by sending large, complex queries repeatedly and concurrently, potentially crashing the service and making it unavailable to legitimate users. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually large or excessively nested GraphQL queries sent to the Hasura GraphQL endpoint, especially repeated requests with extremely long query strings. One practical approach is to capture and analyze network traffic targeting the /v1/graphql endpoint for large payloads or high concurrency. While no specific detection commands are provided, using tools like tcpdump or Wireshark to filter HTTP POST requests to /v1/graphql and inspecting the query size and nesting depth can help. Additionally, reviewing server logs for repeated long queries or spikes in resource usage may indicate exploitation attempts. [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing rate limiting and query complexity analysis on the Hasura GraphQL server to restrict excessively large or deeply nested queries. Limiting the number of concurrent requests and query depth can prevent resource exhaustion. Additionally, updating Hasura GraphQL to a version where this vulnerability is fixed (if available) is recommended. If an update is not immediately possible, consider deploying network-level protections such as web application firewalls (WAF) to block suspicious traffic patterns resembling the described DoS attack. [3]

Useful 0 Not Useful 0