GraphQL injection found in logs

firetail:insight-graphql-injection-in-logs

Type:

Detection

Rule Severity:

Info

Indicators for attempted GraphQL injection were found in the logs of the affected API.

GraphQL injection is a type of security vulnerability where an attacker injects malicious GraphQL queries into your application to manipulate or gain unauthorized access to data. Unlike traditional SQL injection, which targets SQL databases, GraphQL injection targets the GraphQL query language and API.

Remediation

Review the logs in question and verify that any attempted attack was unsuccessful.

Example Attack Scenario

How to Identify with Example Scenario

How to Resolve with Example Scenario

How to Identify with Example Scenario

Find the text in bold to identify issues such as these in API specifications

How to Resolve with Example Scenario

Modify the text in bold to resolve issues such as these in API specifications
References:

More findings

All Findings
JSON deserialization error
Plaintext digest authentication
Mailgun secrets found in logs
Basic HTTP auth
AppSync GraphQL API resolver count limit high
GraphQL client error