Hasura GraphQL Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Hasura GraphQL version 1.3.3. This issue allows attackers to execute arbitrary shell commands by manipulating SQL queries. The vulnerability is exploited through the run_sql endpoint, where crafted GraphQL queries can inject commands that are executed via PostgreSQL's COPY FROM PROGRAM functionality.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where Hasura GraphQL is running.

Reproduction

To reproduce this vulnerability, send a POST request to the Hasura GraphQL server's run_sql endpoint with a GraphQL query that includes the COPY command. The injected command will be executed on the server, and the output can be retrieved by querying the appropriate table.