{"id":"GHSA-68jh-rf6x-836f","aliases":[],"url":"https://o3.security/vulnerability/GHSA-68jh-rf6x-836f","summary":"@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces","details":"### Context\nContent Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack.\n\n### Impact\nThere aren't any XSS attack vectors via the Apollo Server landing pages _known to Apollo_, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be prevented by the current CSP implemented by the landing pages.\n\nPrior to version 4.7.1, there was no CSP implemented at all. However, the initial CSP implementation (4.7.1+) reused nonces. While this sufficiently resolved the issue w.r.t. scripts not running in Safari, it did not implement CSP in a safe or conventional way.\n\n### Patches\nThe issue is patched in the latest version of Apollo Server, v4.7.4. The changes can be reviewed in [the merge commit](https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c).\n\n### Workarounds\nThe landing page can be disabled completely until the patch can be upgraded to.\nhttps://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#disabling-the-landing-page\n\n### References\nhttps://content-security-policy.com/nonce/","published":"2023-06-16T19:40:53Z","modified":"2023-06-20T19:50:40Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@apollo/server","fixedVersion":"4.7.4"}],"fix":{"url":"https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c","label":"apollographql/apollo-server@0adaf80"},"references":[{"type":"WEB","url":"https://github.com/apollographql/apollo-server/security/advisories/GHSA-68jh-rf6x-836f"},{"type":"WEB","url":"https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c"},{"type":"PACKAGE","url":"https://github.com/apollographql/apollo-server"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-06-20T19:50:40Z"}}