Graph Explorer HTTPS Fallback to HTTP Vulnerability

A vulnerability exists in the Graph Explorer proxy server in versions 1.1.0 prior to 3.0.1. When certificate files are missing, the server defaults to HTTP instead of HTTPS, potentially allowing remote attackers to intercept sensitive information from requests meant to be secure.

Impact

Exploitation of this vulnerability could lead to the interception of sensitive information due to unencrypted transmission over HTTP.

Remediation

Users should upgrade to Graph Explorer version 3.0.1 or later. If an immediate upgrade is not possible, verify that the deployment is serving over HTTPS, ensure the HOST is set correctly in the Docker run command for proper certificate generation, and avoid using non-default configuration directory paths that could disrupt automatic self-signed certificate creation.