Dgraph GraphQL Database DQL Injection Vulnerability in checkUserPassword Query

A DQL injection vulnerability has been identified in the Dgraph GraphQL database, affecting versions through 25.3.3. The issue arises in the checkUserPassword query, where user-provided password values are directly inserted into a DQL checkpwd() query using fmt.Sprintf, without proper escaping or parameterization. This flaw allows attackers to inject passwords containing double-quote characters to escape the DQL string literal and append arbitrary DQL query blocks. The vulnerability exists in the GraphQL-to-DQL query rewriting layer, specifically in query_rewriter.go, where the checkpwd() function is constructed with unsanitized input. Exploitation can lead to unauthorized data enumeration, schema discovery, resource exhaustion, and potential data disclosure, depending on the Dgraph configuration.

Impact

Exploitation of this vulnerability allows for DQL injection, where injected query blocks are executed server-side. This can lead to unauthorized data enumeration, schema discovery, resource exhaustion through expensive injected queries, and potential data disclosure, depending on the Dgraph configuration.

Reproduction

To reproduce this vulnerability, send a crafted GraphQL query to the Dgraph server that includes a checkUserPassword request with an injected password value containing a double-quote character. The injection can be verified by observing the execution of the injected DQL query blocks in the Dgraph server logs and the response metrics.

Remediation

Users can upgrade to Dgraph version 25.3.4, which patches this vulnerability by properly escaping and parameterizing password values in the checkUserPassword query.