Strawberry GraphQL Type Confusion Vulnerability in Relay Integration Allows Data Leakage

A type confusion vulnerability has been identified in Strawberry GraphQL versions 0.182.0 prior to 0.257.0. This issue arises in the relay integration when multiple GraphQL types are mapped to the same underlying model, particularly affecting Django, SQLAlchemy, and Pydantic ORM integrations. The vulnerability occurs when the global node field is used to query specific types, potentially leading to incorrect type resolution. This can result in unauthorized access to sensitive information or privileges if the alternate type contains restricted data.

Impact

Exploitation of this vulnerability can lead to information disclosure or privilege escalation by incorrectly resolving types in the relay node interface.

Reproduction

To reproduce this vulnerability, create multiple GraphQL types that inherit from relay.Node and map them to the same underlying database model. Then, use the global node field to query a specific type. The resolver may incorrectly return an instance of a different type mapped to the same model, demonstrating the type confusion vulnerability.

Remediation

Users are advised to update to Strawberry GraphQL version 0.257.0 or later. If using the Strawberry GraphQL Django integration, update to version 0.54.0 or later.