Scanning a GraphQL API for Vulnerabilities | Acunetix

Step 5: Create an Index File to Handle GraphQL Requests

Create a C:wamp64wwwgraphusersindex.php file with the following content:

getMessage(), (int)$e->getCode());
}

​function select_sql($query, $sql_args) {
    global $MyDB;
    $stmt = $MyDB->prepare($query);
    $stmt->execute($sql_args);
    $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
    return $rows;
}

​function insert_sql($query, $sql_args) {
    global $MyDB;
    $stmt = $MyDB->prepare($query);
    return $stmt->execute($sql_args); // true if successful; false if not successful 
}

​function delete_sql($query, $sql_args) {
    global $MyDB;
    $stmt = $MyDB->prepare($query);
    return $stmt->execute($sql_args); // true if successful; false if not successful 
}

$graphQLSyncPromiseAdapter = new SyncPromiseAdapter();
$promiseAdapter = new WebonyxGraphQLSyncPromiseAdapter($graphQLSyncPromiseAdapter);

WGraphQL::setPromiseAdapter($graphQLSyncPromiseAdapter);

$context = [
    'select_sql' => function ($query, $sql_args) { return select_sql($query, $sql_args); },
    'insert_sql' => function ($query, $sql_args) { return insert_sql($query, $sql_args); },
    'delete_sql' => function ($query, $sql_args) { return delete_sql($query, $sql_args); },
];

if (Requestmethod_is('post')) {
    $schema = include __DIR__.'/schema.php';
    Graphqlinit($schema, null, $context);
}

Step 6: Create a Resolvers File

Create a C:wamp64wwwgraphusersresolvers.php file with the following content:

 [
    getUser' => function($root, $args, $context) {
    return $context['select_sql']("SELECT id, fname, lname, email, notes FROM users WHERE email=:email", ['email'=>$args['email']]);
        }
    ],
  'Mutation' => [
    'addUser' => function($root, $args, $context) {
      $dummy = $context['insert_sql']("INSERT INTO users (fname, lname, email, notes) VALUES ('" . $args['fname'] . "', '" . $args['lname'] . "', '" . $args['email'] . "', '" . $args['notes'] . "')", []);
      if ($dummy) {
        return $context['select_sql']("SELECT id, fname, lname, email, notes FROM users WHERE email=:email", ['email'=>$args['email']]);
      }
      return null;
    },
    'delUser' => function($root, $args, $context) {
      $delrecord = $context['select_sql']("SELECT id, fname, lname, email, notes FROM users WHERE email=:email", ['email'=>$args['email']]);
      $dummy = $context['delete_sql']("DELETE FROM users WHERE email=:email", ['email'=>$args['email']]);
      if ($dummy) {
        return $delrecord;
      }
      return null;
    }
  ]
];

Stage 3: Scan Your GraphQL API

In this example, the web service definition is at the following URL: http://localhost/graphusers/schema.graphql. To scan the web service with Acunetix:

1. Create a new target with the following URL: http://localhost/graphusers/
2. Import an amended schema file to your target:
   • Download the schema file from the following URL: http://localhost/graphusers/schema.graphql
   • Insert one line at the top of the file to specify the GraphQL endpoint; the file should look like this:

     graphql_endpoint="/graphusers/";
     type Query {
       getUser(email: String): [User]
     }
     
     type Mutation {
       addUser(fname: String, lname: String, email: String, notes: String): [User]
       deluser(email: String): [User]
     }
     
     type User {
       id: Int
       fname: String
       lname: String
       email: String
       notes: String
     }
     

   • Locate the Import Files section of your target configuration and import the amended schema file
3. Deploy the PHP AcuSensor to your web service
4. Launch a Full Scan of your web service and wait for it to complete

Stage 4: Identify Vulnerabilities in Your GraphQL API

Examine the list of vulnerabilities for your scan. We shall concentrate on the SQL injection vulnerabilities for this exercise, since they all have the same root cause.

Acunetix shows the Attack Details — the GraphQL API call had variables injected with delay commands and Acunetix was able to confirm that the responses were indeed delayed by the specified number of seconds. This confirms that the API call is vulnerable to SQL injection, allowing a malicious hacker to craft additional requests to possibly retrieve large volumes of data.

Stage 5: Resolve the Vulnerabilities

A quick look at the addUser mutation function inside the resolvers.php class file can reveal the root cause. The query is built using string concatenation:

$dummy = $context['insert_sql']("INSERT INTO users (fname, lname, email, notes) VALUES ('" . $args['fname'] . "', '" . $args['lname'] . "', '" . $args['email'] . "', '" . $args['notes'] . "')", []);
]

The $args[‘fname’] variable and other variables are being simply concatenated to the query string without any validation. We can adjust the code by using parameterized queries. The newly-adjusted line in the resolvers.php file would look like this:

$dummy = $context['insert_sql']("INSERT INTO users (fname, lname, email, notes) VALUES (:fname, :lname, :email, :notes)", ['fname'=>$args['fname'],  'lname'=>$args['lname'], 'email'=>$args['email'], 'notes'=>$args['notes']]);

Stage 6: Rescan to Confirm Resolution

Go to the list of vulnerabilities for the scan and select the SQL injection vulnerability you have just resolved.

Click on the Retest button — this will create a new scan to test the selected vulnerabilities again. The results will show that you have successfully resolved the vulnerabilities.

THE AUTHOR

Kevin Attard Compagno
Technical Writer
LinkedIn

Kevin Attard Compagno is a Technical Writer working for Acunetix. A technical writer, translator, and general IT buff for over 30 years, Kevin used to run Technical Support teams and create training documents and other material for in-house technical staff.