Box: GraphQL + Mass Assignment
box · medium · +100 XP
// what is Box: GraphQL + Mass Assignment?
GraphQL introspection + mass assignment — GraphQL was designed for flexible querying, but production endpoints often leave introspection enabled ({ __schema { ... } } lists every type & field). Once you see the schema, mass-assignment is easy: backend code calls User.update(input) and trusts every field, including the role field that was 'never meant to be settable from outside'.
// how attackers detect it
- [01]POST
{ __schema { types { name fields { name } } } }to/graphql. Schema returned? Introspection is on. - [02]Look for mutations with broad
inputtypes —updateProfile,updateUser,updateOrder. Add arole/is_adminfield and see if it sticks. - [03]Tools:
graphw00f,graphql-cop, InQL (Burp extension).
// how defenders prevent it
- ✓Disable introspection in production (Apollo:
introspection: false). Or gate it on auth + role. - ✓Explicit input allow-lists —
pick(input, ['displayName','bio']). NeverUser.update(input)directly. - ✓Resolver-level authorisation — every field that mutates state checks
context.user.role.
// real-world incidents
CVE-2024-32962
Apollo Router CSP bypass via introspection abuse
Public schema → custom-CSP smuggling.
CVE-2022-41917
OpenSearch GraphQL mass-assignment
Privilege escalation via role field in update mutation.
// hands-on tips for this lab
- ›Step 1: introspect → find
updateProfile(input: ProfileInput). Step 2:mutation { updateProfile(input: { role: "admin" }) { role } }. Step 3:GET /me→ flag.
was this lesson helpful?