AshGraphql resolver KeyError on unknown relay type (CWE-252, CVSS 6.9)

AshGraphql Vulnerability Summary Vulnerability Overview Vulnerability Name: Unhandled exception caused by unknown type segments during relay node resolution Severity: Medium (CVSS 6.9/10, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) CWE: CWE-252 (Unchecked Exception) Description: An unauthenticated attacker can trigger an unhandled by sending a query whose type segment is not a known GraphQL type, causing the node resolver to crash and potentially leading to service interruption (DoS). Affected Scope Affected Versions: Fixed Version: Impact: HTTP applications that expose AshGraphql relay node fields are affected, and the issue can be triggered without authentication. Fix In , unknown type segments should return an result instead of throwing an unhandled . Upgrading to 1.1.0 resolves the issue. POC Code (Full Extraction) ```elixir POC: ash_graphql 1.10.1 - unhandled KeyError on attacker-controlled relay node type a AshGraphql.Graphql.Resolver.resolve_node/2 (lib/ash_graphql/resolver.ex:348) does Map.fetch!(type_to_domain_and_resource_map, type) on the type decoded from the client-supplied relay global ID. Any typed ID whose type segment is an existing type that is not a relay-mapped resource type raises KeyError. "before" the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unknown type aborts the resolver before any of the resolve/2 clauses and before AshGraphql.Graphql.Resolver.node/2 - causes a "KeyError: 'before' the unkn

Goal Reached Thanks to every supporter — we hit 100%!

AshGraphql resolver KeyError on unknown relay type (CWE-252, CVSS 6.9)

More from this source