GraphQL Query Depth Denial of Service in Red Hat Advanced Cluster Security

Mitigation Strategies

The provided resources do not specify immediate mitigation steps or workarounds for this vulnerability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Red Hat Advanced Cluster Security (RHACS) Central's GraphQL API, which does not limit the depth of queries that authenticated users can submit.

An authenticated user with a valid API token can send deeply nested GraphQL queries that exploit recursive type relationships in the schema.

These deeply nested queries cause excessive CPU and memory consumption due to the heavy processing required, which leads to a denial of service condition for the Central management plane.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial of service (DoS) in the RHACS Central management plane by exhausting system resources such as CPU and memory.

This means legitimate users and management operations may be unable to access or use the Central component effectively, potentially disrupting security management and monitoring of Kubernetes clusters.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually high CPU and memory usage on the Red Hat Advanced Cluster Security (RHACS) Central component, which may indicate that deeply nested GraphQL queries are being executed.

Since the issue involves authenticated GraphQL API requests with excessive query depth, inspecting API logs for deeply nested GraphQL queries or abnormal query patterns can help identify exploitation attempts.

Specific commands are not provided in the available resources, but general approaches include:

• Using system monitoring tools like top, htop, or ps to observe CPU and memory usage on the Central component.
• Reviewing API access logs or enabling detailed logging on the GraphQL API to detect queries with excessive nesting.

Useful 0 Not Useful 0