AshGraphql 中继解析器未处理异常漏洞（CWE-252）

AshGraphql 漏洞总结 漏洞概述 漏洞名称： 中继节点解析时因未知类型段导致未处理异常（Unhandled exception） 严重等级：中危（CVSS 6.9/10，CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N） CWE：CWE-252（未处理异常） 描述：未认证攻击者可通过发送一个 查询，其类型段不是已知的 GraphQL 类型，从而触发未处理的 ，导致节点解析崩溃，可能引发服务中断（DoS）。 影响范围 受影响版本： 已修复版本： 影响：暴露 AshGraphql 中继节点字段的 HTTP 应用受影响，且无需认证即可触发。 修复方案 在 中，对未知类型段应返回 结果，而不是抛出未处理的 。 升级至 1.1.0 即可修复。 POC 代码（完整提取） ```elixir POC: ash_graphql 1.10.1 - unhandled KeyError on attacker-controlled relay node type a AshGraphql.Graphql.Resolver.resolve_node/2 (lib/ash_graphql/resolver.ex:348) does Map.fetch!(type_to_domain_and_resource_map, type) on the type decoded from the client-supplied relay global ID. Any typed ID whose type segment is an existing type that is not a relay-mapped resource type raises KeyError. "before" the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resol

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

AshGraphql 中继解析器未处理异常漏洞（CWE-252）

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

AshGraphql 中继解析器未处理异常漏洞（CWE-252）

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！