Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The author of this post was testing a chat feature with an API built with GraphQL. Each message, and chat had a unique ID. When attempting to perform an IDOR on the chat ID or message ID directly, a 404 error was returned. So, the access controls were being performed well here.

In the GraphQL query, there's another field that can be used for quoted message: previousMessage.connect.id. This contains the message to attach alongside this one. This ID was NOT protected. If you specified an arbitrary ID on the messageCreate call, it would now add another message. From this, you could chain nested previousMessage fields from that one to leak the entire chat.

GraphQL is a very interesting technology. Each individual field must have a querying engine for it, and access controls on it. Because of this, security seems hard to do correctly on GraphQL. In this case, it led to a pretty nasty information disclosure. Good write up!