“The 16-Hour Window: Catching a GraphQL Authorization Flaw”

During my research into GraphQL security vulnerabilities, I came across a fascinating case where researcher msdian7 discovered a critical information disclosure flaw in HackerOne’s own platform shortly after a code deployment. This case is a perfect example of why rapid security testing after updates is crucial, and how GraphQL implementations can introduce new authorization risks.

free link

The Vulnerability: Missing ACL in GraphQL Migration

The root cause was a classic case of security controls being lost during technology migration. HackerOne was transitioning from REST to GraphQL APIs, and during this process, an important Access Control List (ACL) check wasn’t properly implemented in the new GraphQL layer.

The Technical Details:

• Endpoint: GraphQL mutation AddReportParticipant
• Missing Check: Authorization verification for email visibility
• Impact: Could retrieve any user’s email by username
• Method: Invite users to reports and view the invitation response

The Exploit Query:

mutation Revoke_credential_mutation($input_0:AddReportParticipantInput!) {…