github.com/dgraph-io/dgraph

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.