Hasura GraphQL Local File Read Vulnerability via SQL Injection

A local file read vulnerability has been identified in Hasura GraphQL version 1.3.3. This issue allows attackers to access system files by exploiting SQL injection vulnerabilities in the query endpoint. The vulnerability arises from the improper handling of SQL commands, which can be manipulated to read arbitrary files on the server using the pg_read_file() function in PostgreSQL.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive system files, which could lead to further attacks or exposure of confidential information.

Reproduction

To reproduce this vulnerability, send a POST request to the Hasura GraphQL query endpoint with a crafted SQL query that uses the pg_read_file() function to specify a file path. The SQL injection is possible due to improper sanitization of input, allowing the injection of malicious SQL that is executed by the PostgreSQL database.