Penetration Test Report (Doyensec): Doyensec Apollo Report Q22022 v4 AfterRetest

Security Auditing Report
Apollo Router
Prepared for: Apollo Graph Inc.
Prepared by: Mykhailo Baraniak, Norbert Szetei
Date: 06/16/2022
WWW.DOYENSEC.COM © DOYENSEC
Apollo Graph Inc. / Apollo Router Audit Q2 2022
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 5
Project Findings 6
Appendix A - Vulnerability Classification 23
Appendix B - Remediation Checklist 24
Appendix C - Fuzzing Notes 25
Appendix D - Engagement Test Plan 26
1 of 27 WWW.DOYENSEC.COM
Apollo Graph Inc. / Apollo Router Audit Q2 2022
Revision History
Version Date Description Author
Mykhailo Baraniak
1 05/13/2022 First release of the final report
Norbert Szetei
2 05/13/2022 Peer review Luca Carettoni
3 05/25/2022 Second round of peer review Anthony Trummer
4 06/16/2022 Retesting update Norbert Szetei
Contacts
Company Name Email
Apollo Graph Inc. Jesse Rosenberger jesse@apollographql.com
Apollo Graph Inc. Tad Whitaker tad@apollographql.com
Doyensec, LLC Luca Carettoni luca@doyensec.com
Doyensec, LLC John Villamil john@doyensec.com
2 of 27 WWW.DOYENSEC.COM
Apollo Graph Inc. / Apollo Router Audit Q2 2022
Executive Summary • Manipulation of requests via user-
provided scripts (https://github.com/
rhaiscript/rhai)
Overview
• Open Telemetry extension
Apollo Graph Inc. engaged Doyensec to perform a
The testing took place in a local environment
security assessment of the Apollo Router OSS.
using the latest version of the software at the
The project commenced on 05/02/2022 and
time of testing. For testing, we used the docker
ended on 05/13/2022 requiring two security
images included in the supergraph-demo-fed2
researchers. The project resulted in six (6)
repository.
findings of which three (3) were rated as Medium
severity.
Specifically, this activity was performed on the
following releases:
In June 2022, Doyensec performed a retesting of
the Apollo Router OSS and confirmed the
• apollo-rs
effectiveness of the applied mitigations. All
4e3460ac2b4b6052d8849068e1e161aed14a
issues were mitigated in a timely manner by
9e43
Apollo Graph team. No outstanding security • router
vulnerabilities discovered during this
b7d90eda521dc5b7bd522d94b6311e32cc0f
engagement exist. 99b4
• federation
This deliverable represents the state of all 0a6d737a71f26cf164d056c3d6c57800e401
discovered vulnerabilities as of 06/16/2022. The adf2
retesting was performed using the release v0.9.4. • rhai
ba475a7ad4ceaf4be168a9d5389aea60165f
The project consisted of a manual security 9ce3
assessment of the Apollo Router application,
Scoping Restrictions
which included source code review as well as
dynamic testing and instrumentation.
During the engagement, Doyensec did not
Testing was conducted remotely from Doyensec's encounter any difficulties. The Apollo Graph team
EMEA and US offices. was very helpful and responsive in ensuring a
smooth assessment.
Scope
The JWT plugin was initially included in the list of
targets, but after speaking with the Apollo Graph
Through meetings with the Apollo Graph team,
team, the plugin was considered out of scope.
the scope of the project was clearly defined. The
agreed upon assets are listed below:
Similarly, we agreed to consider all router
configurations, subgraphs, and supergraphs as
• Apollo Router
trusted in our threat model. For this reason, we
• Configurable, high-performance GraphQL
assigned an informational severity to the APO-
router
• 13k lines of Rust code Q222-5 finding. However, we tested the schema
update mechanism (Apollo Uplink) for the
• Including the query planner/federation
possibility of performing MITM and tampering.
repository and apollo-parser
It is important to notice that Apollo Graph is a
• Apollo Router Extensions
highly flexible platform in which several
• Header manipulation for downstream
configurations can be customized by the end user.
requests
3 of 27 WWW.DOYENSEC.COM
Apollo Graph Inc. / Apollo Router Audit Q2 2022
Doyensec focused on vulnerabilities in the core Long-term improvements
logic instead of enumerating potential
misconfigurations in user-defined policies. All • Since availability is one of the main goals of
features that were not enabled by default at the this infrastructure component, consider
time of testing (e.g., the warp web server) were restructuring the code to implement user
also considered out of scope. input processing functions in a segregated
process or thread. The router process should
still survive if the child process crashes
Findings Summary
• Regularly run cargo audit and remove
Doyensec researchers discovered and reported
unmaintained packages. Currently, the
six (6) vulnerabilities in the Apollo Router OSS.
packages failure, net2, and serde_cbor are
deprecated. Replace them with the
While some of the issues are departures from
recommended alternatives
best practices and low-severity flaws, Doyensec
identified three issues rated as Medium severity.
It is important to reiterate that this report
represents a snapshot of the environment’s
security posture at a point in time.
The findings include a Cross-Site Request Forgery
(CSRF) via HEAD request with a mutation query
and two Denial of Service (DoS) issues.
Overall, the security posture of the product was
found to be in line with industry best practices.
At the design level, Doyensec found the system to
be well architected.
Recommendations
The following recommendations are proposed
based on studying the Apollo Router security
posture and the vulnerabilities discovered during
this engagement.
Short-term improvements
• Work on mitigating the discovered
vulnerabilities. You can use Appendix B -
Remediation Checklist to make sure that you
have covered all areas
• Expand the fuzzing effort to further identify
issues that might affect the router availability
and integrity. For inspiration, see Appendix C -
Fuzzing Notes
4 of 27 WWW.DOYENSEC.COM
Apollo Graph Inc. / Apollo Router Audit Q2 2022
Methodology • Cargo-fuzz
• afl.rs
• Curl, netcat and other Linux utilities
Overview
Web Application and API
Doyensec treats each engagement as a fluid Techniques
entity. We use a standard base of tools and
techniques from which we built our own unique
Web assessments are centered around the data
methodology. Our 30 years of information security
sent between clients and servers. In this realm,
experience has taught us that mixing offensive
the principle audit tool is Burp Suite. However, we
and defensive philosophies is the key to standing
also use a large set of custom scripts and
against threats. Thus we recommend a whitebox
extensions to perform specific audit tasks. We
approach combining dynamic fault injection with
focus on authorization, authentication, integrity
an in-depth study of the source code to maximize
and trust. We study how data is interpreted,
the ROI on bug hunting.
parsed, stored, and relayed between producers
and consumers.
During this assessment, we have employed
standard testing methodologies (e.g., OWASP
We subvert the client with malicious data through
Testing guide recommendations), as well as
reflected and DOM based Cross Site Scripting and
custom checklists, to ensure full coverage of both
by breaking assumptions in trust. We test the
code and vulnerability classes.
server endpoints for injection style flaws
including, but not limited to, SQL, template, XML,
Setup Phase and command injection flaws. We look at each
request and response pair for potential Cross Site
Apollo Graph provided one production Request Forgery and race conditions. We study
configuration (prod-schema.graphql). the application for subtle logic issues, whether
they are authorization bypasses or insecure
The source code and other example object references. Session storage and retrieval is
configurations were publicly available via GitHub: scrutinized and user separation is thoroughly
tested.
• https://github.com/apollographql/
supergraph-demo-fed2 Web security is not limited to popular bug titles.
Doyensec researchers understand the goals and
needs of the ap