Mercurius Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in Mercurius, a GraphQL adapter for Fastify, in versions prior to 16.4.0. The issue stems from improper handling of the Content-Type header, allowing requests with certain Content-Type values to be incorrectly interpreted as application/json. This misinterpretation can bypass CORS preflight checks, potentially enabling unauthorized actions on behalf of authenticated users.

Impact

Exploitation of this vulnerability could lead to CSRF attacks, allowing unauthorized actions to be performed on behalf of an authenticated user.

Reproduction

To reproduce this vulnerability, send a POST request to a GraphQL endpoint with a Content-Type header of 'application/x-www-form-urlencoded', 'multipart/form-data', or 'text/plain'. The request will be misinterpreted as 'application/json', bypassing CORS protections and allowing CSRF attacks.

Remediation

Users can update to Mercurius version 16.4.0 or later, where this vulnerability has been patched.