CVE-2019-1000011

Vulnerability

API Platform versions from 2.2.0 to 2.3.5 contain an incorrect access control vulnerability in GraphQL delete mutations. The ItemMutationResolverFactory fails to verify that the resource class of the provided IRI matches the expected resource class for the mutation. This allows a user authorized to delete a specific resource type (e.g., Office) to delete resources of other types (e.g., Book) by passing a different IRI. The issue was reported in issue #2364 [4] and fixed in pull request #2441 [3].

Exploitation

An attacker must have authorization to perform delete mutations on at least one resource class within the API. The attacker can then craft a GraphQL mutation that invokes a delete mutation for a resource they are authorized to delete but provide the IRI of a different resource class they are not authorized to delete. For example, if authorized to delete Office resources, the attacker can supply the IRI of a Book resource (/api/books/240) in the deleteOffice mutation, resulting in the deletion of the book. No additional privileges or user interaction beyond the authorization are required.

Impact

An authenticated attacker with authorization to delete any resource type can delete arbitrary resources of any class, regardless of their permissions on those specific resource classes. This leads to unauthorized data deletion, potentially causing data loss and service disruption. The confidentiality and integrity of the affected resources are compromised as the attacker can remove data they should not have access to delete.

Mitigation

The vulnerability is fixed in API Platform version 2.3.6 [1][2]. Users running versions 2.2.0 through 2.3.5 should upgrade immediately. For those unable to upgrade, as a workaround, custom input validation can be implemented in mutation resolvers to verify that the resource class of the provided IRI matches the expected class, as demonstrated in the fix [3]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.