Information Disclosure in Hasura GraphQL Engine

Executive Summary

This vulnerability exists in Hasura versions prior to 2.49.2 and 2.45.5. It allows a user to use a where clause on a table computed field that returns a set of rows (SETOF some_table) to infer values of rows that should be filtered based on row-level permissions for their role.

Although the rows cannot be returned directly due to permissions, the where clause predicates can be used as an oracle to efficiently brute force and infer these values.

This means an attacker can deduce sensitive data that should have been protected by row-level security.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized inference of sensitive data that should be protected by row-level permissions.

Attackers can use the where clause as an oracle to brute force and discover values from restricted rows, potentially exposing confidential or sensitive information.

This undermines the intended access controls and can lead to data leakage even if direct access to the rows is not granted.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Hasura to version 2.49.2 or 2.45.5 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to infer filtered row values that should be restricted by row-level permissions, impacting the confidentiality of data.

Since confidentiality is a key aspect of compliance with standards like GDPR and HIPAA, this issue could lead to unauthorized disclosure of sensitive information, thereby potentially causing non-compliance with these regulations.

However, the vulnerability does not allow direct data modification or affect availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of a where clause on a table computed field in Hasura GraphQL Engine versions between v2.45.0 and v2.49.1 (excluding v2.45.5) to infer filtered row values that should be restricted by row-level permissions.

To detect if your system is vulnerable, first verify the Hasura GraphQL Engine version in use. If it falls within the affected versions, you can attempt to identify exploitation attempts by monitoring GraphQL queries that use where clauses on computed fields returning sets of rows.

Suggested commands to check the Hasura version and monitor queries include:

• Check Hasura version via API or CLI: `hasura version` or querying the metadata API.
• Monitor GraphQL queries for suspicious where clauses on computed fields by enabling query logging or using network monitoring tools to capture GraphQL requests.
• Use grep or similar tools on logs to search for patterns like `where` clauses on computed fields, e.g., `grep -i 'where.*computed_field' /path/to/hasura/logs`.

As a temporary mitigation, untrack affected computed fields from the Hasura metadata to prevent exploitation until the system is upgraded.

Useful 0 Not Useful 0