GraphQL field suggestions provide auto-complete suggestions for available fields, enabling attackers to gain insights into data structures, potentially leading to data exposure and targeted attacks on the API.
Security Misconfiguration (SM)
How this template works
APIs Selection
The template uses a regular expression filter to select APIs with URLs containing the word "graphql". This ensures that only relevant APIs are targeted for the security test.
Execute request
The template executes a single request by modifying the URL to include "graphql" and replaces the request body with a GraphQL introspection query. This query retrieves schema details from the API.
Validation
The template validates the response payload to check if it contains either the phrases "Did you mean" or "Expected value of type". If either of these phrases is present, it indicates a potential security misconfiguration in the GraphQL implementation.
Frequently asked questions
What is the purpose of the "Graphql Field Suggestions Enabled" test
How does the test identify the security misconfiguration
What is the impact of enabling GraphQL field suggestions
What is the severity level of this security misconfiguration
What are the tags associated with this test
Are there any references or resources for further information on this test
"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "
Security team,
Rippling
