Hasura GraphQL Engine Server-Side-Request-Forgery Scanner

Hasura GraphQL Engine is a high-performance, open-source platform that instantly provides a real-time GraphQL API over new or existing databases. It is widely adopted by developers and enterprises to accelerate API development, enabling instant data access with built-in authorization and caching. The engine integrates seamlessly with various data sources, including PostgreSQL, and is often deployed in cloud environments to power dynamic, data-intensive applications.

Server-Side Request Forgery (SSRF) in Hasura GraphQL Engine arises when the application processes user-supplied URLs without adequate validation. This vulnerability occurs because the engine's GraphQL endpoint may accept external URLs for operations like remote schema stitching or webhook calls, allowing an attacker to manipulate the server into making requests to internal or arbitrary external systems.

Specifically, the vulnerability targets the GraphQL endpoint's mutation or query parameters that accept URLs, such as those used for remote schemas or event triggers. An attacker can craft a malicious GraphQL request that includes a URL pointing to an internal service (e.g., http://localhost:8080/admin) or an external resource, causing the server to fetch data from that location and potentially leak sensitive information.

If exploited, an SSRF vulnerability can lead to unauthorized access to internal systems, data exfiltration, or interaction with cloud metadata services. Attackers may use this to bypass firewalls, access internal APIs, or perform port scanning of internal networks, potentially compromising the entire infrastructure and leading to significant data breaches or service disruption.