GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. Some web applications provide a friendly user interface to help developers building GraphQL queries and get the results.

The scanner detected the presence of one or more GraphQL interfaces.

GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. It is a popular alternative to traditional REST or SOAP APIs, providing flexibility and an optimized data fetching method.

The scanner detected the usage of GraphQL on the target application.

GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. GraphQL introspection allows to query all information related to the supported schema and queries on a GraphQL server instance. By leveraging this misconfiguration, an attacker could retrieve sensitive information or conduct further attacks on the discovered endpoints.

The scanner detected that GraphQL introspection is enabled on one of several endpoints of the target application.

GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. GraphQL servers often allow other `Content-Type` header values than `application/json`, and GET based requests for both queries and mutations. By leveraging this, an attacker could achieve a Cross-Site Request Forgery (CSRF) attack and make an authenticated user perform arbitrary actions on the target GraphQL endpoint.

GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. By default, GraphQL has a feature which suggests field names to be used in the queries or mutations from the wrong ones provided in the received requests. By leveraging this capability, an attacker could conduct a bruteforce attack to discover the GraphQL schema and potential hidden or private endpoints, and could try accessing sensitive information or performing arbitrary actions on the target server.

The scanner detected that the remote GraphQL server has field suggestions enabled.

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a data structure for securely transmitting claims between parties as a JSON object. A JSON Web Token can be instantiated as a JSON Web Signature (JWS) or a JSON Web Encryption (JWE) depending on the application security considerations.

JSON Web Signature based tokens are the most commonly used in API implementations and are built with three base64 URL encoded parts separated by periods :

- JSON Object Signing and Encryption (JOSE) header : describes at least the algorithm used for signing or encryption (alg) and the type (typ) of the content being processed. For JSON Web Tokens, the type will usually be set to 'JWT'.

- Payload : JSON object containing the claims to share. Claims can be of three classes : registered (from the specification), public or private and their names must be unique inside the claims set.

- Signature : computed by using the specific algorithm in header and a secret or a private key. This ensures the integrity of the JSON Web Token.

The scanner detected the presence of a JSON Web Signature based token containing the information provided in the output.

Oracle Java SE versions 15, 17 and 18 and Oracle GraalVM Enterprise Edition versions 21.3.1 and 22.0.0.2 do not properly verify Ellipic Curve Digital Signature Algorithm (ECDSA) based signatures. By forcing the `r` and `s` components values of the signature to zero, an attacker could forge a valid signature for any message and public key which would be accepted by the vulnerable library or component version. Attackers could leverage this vulnerability to bypass any security mechanism relying on this algorithm and its Java implementation.

JSON Web Tokens can be signed to protect against data tampering. By using an asymmetric or a symmetric signing algorithm, the application computes a signature of the token data which will be verified during token decoding to ensure its integrity. When using a symmetric algorithm, the signature is created from the chosen HMAC function along with a secret key.

Using weak keys makes it vulnerable to bruteforce attacks, allowing tokens to be manipulated and signed on behalf of the application. Depending on the token usage, attackers could leverage this vulnerability to forge valid tokens and impersonate other users, or gain further privileges.

JSON Web Tokens can be signed to protect against data tampering. By using an asymmetric or a symmetric signing algorithm, the application computes a signature of the token data which will be verified during token decoding to ensure its integrity.

JSON Web Tokens can be configured by an application with the 'none' algorithm and an empty signature, leaving the data unsigned and mutable without any verification. In addition, some libraries used to handle JSON Web Tokens may also have a bad implementation of this algorithm, leading to the tokens set with the 'none' algorithm being verified even when they are originally created with a signature.

Depending on the token usage, attackers could leverage this vulnerability to forge valid tokens and impersonate other users, or gain further privileges.

ID	Name	Product	Family	Published	Updated	Severity
112907	GraphQL Interface Detected	Web Application Scanning	Web Applications	7/22/2021	7/22/2021	info
112809	GraphQL Detected	Web Application Scanning	Web Applications	6/22/2021	6/22/2021	info
112894	GraphQL Introspection Enabled	Web Application Scanning	Web Applications	7/12/2021	9/7/2021	medium
112920	GraphQL Cross-Site Request Forgery	Web Application Scanning	Cross Site Request Forgery	9/26/2022	9/26/2022	medium
112895	GraphQL Field Suggestions Detected	Web Application Scanning	Web Applications	7/19/2021	9/7/2021	medium
112686	JSON Web Token Detected	Web Application Scanning	Web Applications	2/8/2021	2/8/2021	info
113242	Java Psychic Signatures	Web Application Scanning	Component Vulnerability	6/28/2022	6/28/2022	high
112697	JSON Web Token Weak Secret	Web Application Scanning	Web Applications	2/11/2021	9/7/2021	high
112703	JSON Web Token None Hashing Algorithm	Web Application Scanning	Web Applications	2/16/2021	3/8/2023	high

Plugins Search

info

info

medium

medium

medium

info

high

high

high