GraphQL Ruby Remote Code Execution Vulnerability in Schema Loading

A remote code execution vulnerability exists in the GraphQL Ruby library, specifically in versions 1.11.5 prior to 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21. The issue arises when a malicious schema is loaded via 'GraphQL::Schema.from_introspection' or 'GraphQL::Schema::Loader.load'. Systems that use the 'graphql-client' gem to load external schemas through GraphQL introspection are also vulnerable. The vulnerability can be exploited by any authenticated user who transfers a crafted project using the Direct Transfer feature, which is in beta and off by default for self-managed GitLab instances.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where the vulnerable GraphQL schema is loaded.

Reproduction

To reproduce this vulnerability, first enable the Direct Transfer feature on a self-managed GitLab instance. Then, load a maliciously crafted schema into a project using 'GraphQL::Schema.from_introspection' or 'GraphQL::Schema::Loader.load'. This can be done by an authenticated user through the GitLab interface.

Remediation

Upgrade to GraphQL Ruby versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, or 2.3.21.