Without a query depth limit, the AppSync API is more susceptible to resource exhaustion from deeply nested queries. This could result in excessive memory and CPU consumption, negatively impacting the API’s performance and availability. As the API processes deeply nested queries, it could slow down or become unresponsive, affecting user experience and potentially disrupting critical services.
An attacker notices that the AppSync GraphQL API does not have a query depth limit and decides to exploit this by sending a deeply nested query. The query retrieves a list of users and for each user, retrieves their posts, then for each post, retrieves its comments, and for each comment, retrieves the list of likes, each like having its associated user.
Without a query depth limit, the server is forced to process each level of nested data. The request could have hundreds or thousands of nested likes, comments, and posts depending on how many users are in the system. This causes the backend to use more CPU, memory, and network bandwidth than it can handle.
Impact:
