CVE-2021-47715— Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection
Quick assessment
Affected
Hasura Hasura GraphQL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hasura GraphQL Engine是Hasura开源的一个非常快速的 GraphQL 服务器。 Hasura GraphQL Engine 1.3.3版本存在代码问题漏洞，该漏洞源于远程模式URL注入可能导致服务端请求伪造。
Possible ATT&CK Techniques 3 AI
T1598 · Phishing for Information T1046 · Network Service Discovery T1071.001 · Web ProtocolsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Hasura | Hasura GraphQL | 1.3.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-47715
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection
Source: CVE Program / CVE List V5
Vulnerability Description
Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Hasura GraphQL Engine 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Hasura GraphQL Engine是Hasura开源的一个非常快速的 GraphQL 服务器。 Hasura GraphQL Engine 1.3.3版本存在代码问题漏洞，该漏洞源于远程模式URL注入可能导致服务端请求伪造。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Hasura | Hasura GraphQL | 1.3.3 | - |
|
II. Public POCs for CVE-2021-47715
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47715
请登录查看更多情报信息。
Same Patch Batch · Hasura · 2025-12-22 · 3 CVEs total
| CVE-2021-47713 | 7.5 HIGH | Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query |
| CVE-2021-47714 | 5.5 MEDIUM | Hasura GraphQL 1.3.3 Local File Read via SQL Injection |
IV. Related Vulnerabilities
Same vendor: Hasura
-
CVE-2026-54698
Hasura: Row-level authorization bypass on table computed fie -
CVE-2021-47748
Hasura GraphQL 1.3.3 - Remote Code Execution -
CVE-2021-47714
Hasura GraphQL 1.3.3 Local File Read via SQL Injection -
CVE-2021-47713
Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL -
CVE-2023-27588
Unauthenticated path traversal vulnerability in Hasura Graph
Same weakness: CWE-918
-
CVE-2026-77310
jackson-databind: Eager DNS resolution (SSRF) still present -
CVE-2026-76838
Hi.Events before 1.11.1-beta Server-Side Request Forgery via -
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage -
CVE-2026-78385
RansomLook Analysis PDF Generation Allows Server-Side Reques -
CVE-2026-78277
WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Reque
V. Comments for CVE-2021-47715
No comments yet