Apollo Router vulnerable to Critical Regression In Query Plan Cache
Date: 2024-05
Affected: rust/apollo-router
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-32971
CWE: CWE-440
CVSS: 9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

### Impact Any instance of Apollo Router 1.44.0 or 1.45.0 that is using Distributed Query Plan Caching is impacted. These versions were released on 2024-04-12 and 2024-04-22 respectively. The affected versions of Apollo Router contain a bug that could lead to unexpected operations being executed, which can result in unintended data or effects. This only affects Router instances configured to use distributed query plan caching. Router versions other than the ones listed above, and all Router deployments that are not using distributed query plan caching, are unaffected by this defect. If you are using the affected versions, you can check your router’s configuration YAML to verify if you are impacted: ```yaml supergraph: query_planning: cache: # Look for this config below redis: urls: ["redis://..."] ``` A full reference on the[ Distributed Query Plan Caching feature is available here.](https://www.apollographql.com/docs/router/configuration/distributed-caching/#distributed-query-plan-caching) ### Impact detail The root cause of this defect is a bug in Apollo Router’s cache retrieval logic: When this defect is present and distributed query planning caching is enabled, asking the Router to execute an operation (whether it is a query, a mutation, or a subscription) may result in an unexpected variation of that operation being executed or the generation of unexpected errors. The issue stems from inadvertently executing a modified version of a previ


Mitigations:

Architectural layers (MAESTRO):