Skip to content

Latest commit

 

History

History
119 lines (89 loc) · 9.79 KB

attack-tree.md

File metadata and controls

119 lines (89 loc) · 9.79 KB

Attack Tree Analysis for 99designs/gqlgen

Objective: Unauthorized Access/DoS via gqlgen Exploitation

Attack Tree Visualization

Attacker Goal: Unauthorized Access/DoS via gqlgen Exploitation ├── 1. Introspection Abuse [CN] │ ├── 1.1 Schema Leakage Leading to Targeted Attacks [HR] │ │ ├── 1.1.1.1 Craft Queries/Mutations Targeting Discovered Functionality [HR] │ │ └── 1.1.2.1 Analyze Resolver Logic for Vulnerabilities (e.g., SQLi, Auth Bypass) [HR] ├── 2. Resolver Exploitation [CN] │ ├── 2.1 Bypassing Authentication/Authorization in Resolvers [HR] │ │ ├── 2.1.1.1 Exploit Missing or Flawed User Identity/Role Checks [HR] │ │ └── 2.1.2.1 Access Data/Mutations Without Required Permissions [HR] │ ├── 2.2 Injection Vulnerabilities in Resolvers [HR] │ │ ├── 2.2.1.1 Craft Malicious Input to Manipulate SQL Queries [HR] ├── 3. Configuration Errors Specific to gqlgen [CN] │ ├── 3.2 Disabled or Misconfigured Complexity Limits [HR] │ │ └── 3.2.1.1 Enable DoS Attacks via Resource Exhaustion [HR]

Attack Tree Path: 1. Introspection Abuse [CN]

  • Description: Introspection is a GraphQL feature that allows clients to query the schema itself, discovering available types, fields, queries, and mutations. While useful for development, it can be a significant security risk if exposed in production.
  • Why Critical: It's the foundation for many other attacks. It provides the attacker with a "map" of the API.
  • High-Risk Paths:

Attack Tree Path: 1.1 Schema Leakage Leading to Targeted Attacks [HR]

  • (L, I, E, S, D): (Medium, High, Low, Intermediate, Medium)
    • Vulnerability: Introspection is enabled in a production environment.
    • Attack Vector: An attacker sends introspection queries to the GraphQL endpoint to retrieve the entire schema.
    • Impact: The attacker gains full knowledge of the API, including potentially hidden fields, mutations, and data relationships. This information can be used to craft highly targeted attacks.
    • Mitigation: Disable introspection in production. If needed for specific tools, restrict access to authorized users/IPs.

Attack Tree Path: 1.1.1.1 Craft Queries/Mutations Targeting Discovered Functionality [HR]

  • (L, I, E, S, D): (High, High, Medium, Intermediate, Medium)
    • Vulnerability: Hidden or poorly documented functionality exists within the schema, revealed through introspection.
    • Attack Vector: After discovering hidden fields or mutations (e.g., adminDeleteUser), the attacker crafts specific queries or mutations to exploit them.
    • Impact: Unauthorized access to sensitive data or functionality, potentially leading to data breaches, account takeovers, or system compromise.
    • Mitigation: Implement strong authorization checks on all fields and mutations, regardless of whether they are publicly documented. Use field-level authorization directives.

Attack Tree Path: 1.1.2.1 Analyze Resolver Logic for Vulnerabilities [HR]

  • (L, I, E, S, D): (High, High, High, Advanced, Hard)
    • Vulnerability: Weaknesses in resolver implementation (e.g., lack of input validation, improper error handling) are indirectly exposed through the schema.
    • Attack Vector: The attacker analyzes the schema to infer the underlying data sources and technologies used. They then use this information to craft attacks targeting common vulnerabilities in those technologies (e.g., SQL injection if a relational database is used).
    • Impact: Successful exploitation of vulnerabilities in resolvers, leading to data breaches, code execution, or denial of service.
    • Mitigation: Thoroughly review and test all resolver code for security vulnerabilities. Follow secure coding practices.

Attack Tree Path: 2. Resolver Exploitation [CN]

  • Description: Resolvers are the functions that fetch the data for each field in a GraphQL query. They are the core of the application's logic and are often the target of attacks.
  • Why Critical: Resolvers are where the application interacts with data sources and external services, making them prime targets for exploitation.
  • High-Risk Paths:

Attack Tree Path: 2.1 Bypassing Authentication/Authorization in Resolvers [HR]

  • (L, I, E, S, D): (High, High, Medium, Intermediate, Medium)
    • Vulnerability: Missing, incomplete, or incorrectly implemented authentication and authorization checks within resolvers.
    • Attack Vector: An attacker sends queries or mutations that should require authentication or specific permissions, but the resolver fails to enforce these checks.
    • Impact: Unauthorized access to sensitive data or functionality.
    • Mitigation: Implement robust authentication and authorization checks within each resolver. Use the context (ctx) to verify user identity and permissions. Use gqlgen's directives for declarative authorization.

Attack Tree Path: 2.1.1.1 Exploit Missing or Flawed User Identity/Role Checks [HR]

  • (L, I, E, S, D): (High, High, Medium, Intermediate, Medium)
    • Vulnerability: The resolver does not properly check the user's identity or role from the context.
    • Attack Vector: An attacker sends a request, and the resolver processes it without verifying if the user is authorized.
    • Impact: Unauthorized access to data or functionality.
    • Mitigation: Ensure resolvers always check user identity and roles from the context before performing any actions.

Attack Tree Path: 2.1.2.1 Access Data/Mutations Without Required Permissions [HR]

  • (L, I, E, S, D): (High, High, Low, Intermediate, Medium)
    • Vulnerability: gqlgen authorization directives are not used, or are used incorrectly.
    • Attack Vector: An attacker sends a request that should be blocked by authorization rules, but the rules are not enforced.
    • Impact: Unauthorized access to data or functionality.
    • Mitigation: Consistently use gqlgen's authorization directives to define and enforce access control rules.

Attack Tree Path: 2.2 Injection Vulnerabilities in Resolvers [HR]

  • (L, I, E, S, D): (High, Very High, High, Advanced, Hard)
    • Vulnerability: User-supplied input is not properly sanitized or validated before being used in database queries, system commands, or other sensitive operations.
    • Attack Vector: An attacker injects malicious code (e.g., SQL, NoSQL, command injection) into input fields, which is then executed by the resolver.
    • Impact: Data breaches, data modification, code execution, system compromise.
    • Mitigation: Use parameterized queries/prepared statements for all database interactions. Validate and sanitize all user input. Avoid executing system commands based on user input.

Attack Tree Path: 2.2.1.1 Craft Malicious Input to Manipulate SQL Queries [HR]

  • (L, I, E, S, D): (High, Very High, Medium, Advanced, Hard)
    • Vulnerability: The resolver uses string concatenation to build SQL queries with user-supplied input.
    • Attack Vector: An attacker provides input containing SQL code (e.g., ' OR 1=1 --) that alters the query's logic.
    • Impact: Data breaches, data modification, unauthorized access.
    • Mitigation: Always use parameterized queries or prepared statements. Never construct SQL queries using string concatenation with user input.

Attack Tree Path: 3. Configuration Errors Specific to gqlgen [CN]

  • Description: Incorrect configuration of gqlgen itself can introduce vulnerabilities.
  • Why Critical: Configuration errors can bypass even well-written resolver logic.
  • High-Risk Paths:

Attack Tree Path: 3.2 Disabled or Misconfigured Complexity Limits [HR]

  • (L, I, E, S, D): (High, Medium, Low, Novice, Easy)
    • Vulnerability: gqlgen's query complexity limiting feature is disabled or set to an excessively high value.
    • Attack Vector: An attacker sends a very complex, deeply nested query that consumes excessive server resources.
    • Impact: Denial of service (DoS) due to resource exhaustion (CPU, memory).
    • Mitigation: Enable and configure query complexity limits in gqlgen. Set reasonable thresholds based on your application's needs and resources.

Attack Tree Path: 3.2.1.1 Enable DoS Attacks via Resource Exhaustion [HR]

  • (L, I, E, S, D): (High, Medium, Low, Novice, Medium)
    • Vulnerability: Direct consequence of disabled/misconfigured complexity limits.
    • Attack Vector: An attacker repeatedly sends complex queries, overwhelming the server.
    • Impact: Denial of service.
    • Mitigation: Implement and tune complexity limits. Consider additional rate limiting and resource monitoring.