API Platform Core Security Vulnerability in GraphQL Resolvers

A vulnerability exists in API Platform Core versions 3.3.8 and later, where a security check intended to be applied after GraphQL resolvers is improperly managed. The issue arises because there is no interruption in the processing clause, causing the security check to default to a broader 'security' category. This flaw creates a potential risk when only the security check after the resolver is present, without any internal security checks. The vulnerability has been addressed in version 3.3.15.

Impact

Exploitation of this vulnerability could lead to improper handling of security checks in GraphQL operations, potentially allowing unauthorized access or actions.

Reproduction

To reproduce this vulnerability, create a GraphQL endpoint that includes a security check to be applied after the resolver. Then, send a request that triggers this endpoint, ensuring that the security check after the resolver is the only one being applied.

Remediation

Users can update to API Platform Core version 3.3.15 or later, where this vulnerability has been patched.