Security Test: Field suggestion¶

Description¶

Default Severity: medium

When a slight typo in a GraphQL query makes the system throw an error, the error message might suggest valid fields from your backend schema. This might be seen as convenient but it actually gives attackers clues about your system's inner workings. Many developers think that turning off introspection stops all schema details from leaking, but error messages can still reveal key elements that help attackers understand your framework. If an attacker pieces together enough of these hints, they could identify weak spots in your code and plan targeted attacks. The pitfall here is assuming that minimal error mishandling is harmless, while in reality even small hints can make your backend more visible to potential threats.

Reference:

• https://blog.yeswehack.com/yeswerhackers/how-exploit-graphql-endpoint-bug-bounty/

Configuration¶

Identifier: information_disclosure/graphql_field_suggestion

Examples¶

All configuration available:

checks:
  information_disclosure/graphql_field_suggestion:
    skip: false # default

Compliance and Standards¶