GHSA-cqmq-8755-7xvh
Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @keystone-6/core | < 6.5.3 | 6.5.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
# Summary
The value of `graphql.maxTake` can be bypassed by providing a negative input.
This can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set.
# Impact
This affects any project relying on `graphql.maxTake` to bound the number of items returned per query.
# Patches
This issue has been patched in `@keystone-6/core` version `6.5.3`.
If you cannot patch, you can workaround this by restricting `take` input values in your GraphQL queries to the bounded value, or by blocking negative values.
# Credit
This issue was found by [Haxset's](https://haxset.com) Security Scanner and validated by their team.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh
- https://github.com/keystonejs/keystone/pull/9859
- https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1
- https://github.com/keystonejs/keystone
- https://github.com/keystonejs/keystone/releases/tag/@keystone-6/[email protected]